The agent speaks protocol. The interlock speaks physics.

Anthropic has published a hardware standard for letting AI agents command physical machines. The technology press filed it under AI announcements, somewhere between chatbots and chip roadmaps. Wrong shelf. If you run plants, file it under capital equipment: a new port on the control cabinet, one that accepts orders from software which updates itself overnight. It will arrive inside next year's machines whether your purchase spec, safety case or validation plan mentions it or not, because it is already on the machine builders' roadmaps.

What agent-ready means on the cabinet door

Open the cabinet the way you would at any factory acceptance test. Terminal blocks, PLC, safety relay, drive feeds. The furniture has not changed. What is new is a gateway module: it speaks OPC UA or MQTT upward toward the MES layer and hands structured commands downward to the PLC. The command channel is authenticated by a service account or an API token. The actuator path is untouched – PLC output, hydraulic valve, servo axis.

The port is the seam. Nobody owns it. The machine vendor builds the cabinet and assumes IT governs the key. IT issues the key and assumes the cabinet is safe. The integrator sequences the cell and assumes someone else validated the interface. Your equipment spec – capability studies, safety validation, spares list, buy-off criteria – says nothing about any of it. In the vendor's slide deck, that port is a bullet point titled agent-ready.

Your safety case assumed a human hand

Every safety function on that machine is a measured bet on human slowness. Light curtains sit where they sit because a hand approaches at 1,600 mm/s and a human needs reaction time on top of that. Performance levels under ISO 13849 are calculated from decades of data about how operators misuse machines: reaching in, defeating a door switch with a screwdriver, hitting the wrong button in hour nine of a shift. Guard locking and e-stops exist to interrupt a human action in progress. None of it models a commander that is authorised, non-human and wrong at network speed. Show me the PFMEA whose failure modes include "commander updated its own policy overnight and now interprets hold differently." It does not exist. The risk frameworks in circulation – NIST's, the EU's – classify the model. Not one of them positions a light curtain.

I met this failure class in another setting. A few years ago I disclosed a clickjacking flaw through T-Mobile's bug-bounty programme; it is why their public Hall of Fame carries my name. A page could be framed so that a genuine user's genuine click, inside a legitimate session with valid credentials, performed an action across a trust boundary nobody had validated. Nothing was hacked. Every component was authentic. Only the outcome was wrong. The agent-to-actuator interface is the same seam, with tonnes of steel on the far side.

Authentication proves who sent the command. It has never proved the command was worth sending – and physics settles the difference.

I get a daily reminder of how confidently software can be wrong. I built a platform that runs 63+ AI models in parallel for exactly that reason: individual models are fluent, assured and mistaken, sometimes all three before lunch. Speed plus credentials is not a control. Verification is.

Fuzz the seam before it becomes installed base

The answer is not to ban the port. It is to test the seam the way a penetration tester would, while the machine is still the supplier's problem instead of yours. At FAT and SAT, the command path goes on the test plan:

• Malformed commands – truncated payloads, wrong units, out-of-range setpoints. The machine must reject, not interpret.
• Replay – a valid clamp command re-sent after a fixture change or a completed cycle. Rejection behaviour must be defined.
• Out-of-sequence commands – cycle start with guards satisfied but no part present, recipe B parameters running under recipe A.
• Interrupted sessions – comms lost mid-stroke, gateway power pulled with the axis moving, stale credentials after recovery.

For every case, documented safe-state behaviour: hold, controlled stop or category 0. Witnessed and signed into the acceptance criteria, not negotiated after the first crashed die.

I learned that lesson building the QA/QC department for a 900+ employee greenfield plant, writing its equipment buy-off procedures from an empty building outward. The purchase spec is the only real leverage a quality director ever has. Before final payment, suppliers agree to almost anything reasonable. After commissioning you are raising paid change requests against installed base, negotiating with people who already have your money and a service contract. The agent clause costs a paragraph now. The same behaviour retrofitted later costs a shutdown – if a retrofit is possible at all.

Standards from the vendor world arrive at software speed. Plants absorb them at capital-equipment speed, which is slower and irreversible. The seam between decision and actuator will be validated somewhere: in your FAT protocol, or in an 8D report with photographs and a line-down counter. The next machine you buy will have a port that listens. The open question is whether anyone tested what happens when it hears something stupid. Write the clause while the supplier still wants your signature. Once the machine is commissioned, you are negotiating with installed base.