Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Securing AI Agents in Cyber-Physical Systems: A Survey of Environmental Interactions, Deepfake Threats, and Defenses

Mohsen Hatami, Van Tuan Pham, Hozefa Lakadawala, Yu Chen

TL;DR

This survey addresses how deepfakes threaten AI-enabled CPS and argues that detection alone is insufficient. It introduces the SENTINEL lifecycle framework to systematically characterize threats, assess CPS constraints, select defenses, and validate deployments, with continuous adaptation. A key contribution is the MCP-focused threat taxonomy and defense architecture, including provenance, environmental anchors, and physics-grounded validation demonstrated in the ANCHOR-Grid case study. The work highlights open challenges and actionable directions for integrating cross-domain defenses to achieve trustworthy, safety-critical AI-enabled CPS.

Abstract

The increasing integration of AI agents into cyber-physical systems (CPS) introduces new security risks that extend beyond traditional cyber or physical threat models. Recent advances in generative AI enable deepfake and semantic manipulation attacks that can compromise agent perception, reasoning, and interaction with the physical environment, while emerging protocols such as the Model Context Protocol (MCP) further expand the attack surface through dynamic tool use and cross-domain context sharing. This survey provides a comprehensive review of security threats targeting AI agents in CPS, with a particular focus on environmental interactions, deepfake-driven attacks, and MCP-mediated vulnerabilities. We organize the literature using the SENTINEL framework, a lifecycle-aware methodology that integrates threat characterization, feasibility analysis under CPS constraints, defense selection, and continuous validation. Through an end-to-end case study grounded in a real-world smart grid deployment, we quantitatively illustrate how timing, noise, and false-positive costs constrain deployable defenses, and why detection mechanisms alone are insufficient as decision authorities in safety-critical CPS. The survey highlights the role of provenance- and physics-grounded trust mechanisms and defense-in-depth architectures, and outlines open challenges toward trustworthy AI-enabled CPS.

Securing AI Agents in Cyber-Physical Systems: A Survey of Environmental Interactions, Deepfake Threats, and Defenses

TL;DR

This survey addresses how deepfakes threaten AI-enabled CPS and argues that detection alone is insufficient. It introduces the SENTINEL lifecycle framework to systematically characterize threats, assess CPS constraints, select defenses, and validate deployments, with continuous adaptation. A key contribution is the MCP-focused threat taxonomy and defense architecture, including provenance, environmental anchors, and physics-grounded validation demonstrated in the ANCHOR-Grid case study. The work highlights open challenges and actionable directions for integrating cross-domain defenses to achieve trustworthy, safety-critical AI-enabled CPS.

Abstract

The increasing integration of AI agents into cyber-physical systems (CPS) introduces new security risks that extend beyond traditional cyber or physical threat models. Recent advances in generative AI enable deepfake and semantic manipulation attacks that can compromise agent perception, reasoning, and interaction with the physical environment, while emerging protocols such as the Model Context Protocol (MCP) further expand the attack surface through dynamic tool use and cross-domain context sharing. This survey provides a comprehensive review of security threats targeting AI agents in CPS, with a particular focus on environmental interactions, deepfake-driven attacks, and MCP-mediated vulnerabilities. We organize the literature using the SENTINEL framework, a lifecycle-aware methodology that integrates threat characterization, feasibility analysis under CPS constraints, defense selection, and continuous validation. Through an end-to-end case study grounded in a real-world smart grid deployment, we quantitatively illustrate how timing, noise, and false-positive costs constrain deployable defenses, and why detection mechanisms alone are insufficient as decision authorities in safety-critical CPS. The survey highlights the role of provenance- and physics-grounded trust mechanisms and defense-in-depth architectures, and outlines open challenges toward trustworthy AI-enabled CPS.
Paper Structure (111 sections, 14 figures, 31 tables)

This paper contains 111 sections, 14 figures, 31 tables.

Table of Contents

  1. Introduction
  2. Background
  3. Cyber–Physical Systems (CPS) and Security Context
  4. AI Agents and Agent Protocols
  5. Model Context Protocol (MCP)
  6. Deepfake (AI-Generated Content) Technologies
  7. Summary
  8. SENTINEL Framework: Systematic Evaluation and Threat-Informed Defense Selection
  9. Phase 1: System Characterization and Requirement Analysis
  10. Phase 2: Threat Profiling and Attack Surface Analysis
  11. Phase 3: Constraint-Aware Defense Mechanism Selection
  12. Phase 4: Defense-in-Depth Architecture Design
  13. Phase 5: Validation and Deployment Planning
  14. Phase 6: Continuous Monitoring and Adaptive Defense
  15. Framework Application Methodology
  16. ...and 96 more sections

Figures (14)

  • Figure 1: Cyber-Physical Systems (CPS) and Security Context.
  • Figure 2: Al Agents and Agent Protocols.
  • Figure 3: Model Context Protocol (MCP) System.
  • Figure 4: Deepfake (Al-Generated Content) Technologies.
  • Figure 5: MCP threat-boundaries.
  • ...and 9 more figures