PLCBench: Can Autonomous LLM Agents Turn PLC Access into Sustained Physical Impact?

• URL: http://arxiv.org/abs/2608.26882v1
• Date: Thu, 27 Aug 2026 09:40:11 GMT
• Title: PLCBench: Can Autonomous LLM Agents Turn PLC Access into Sustained Physical Impact?
• Abstract summary: PLCBENCH is the first real-PLC hardware-in-the-loop framework for characterizing cyber-to-physical capability and its boundaries.<n>It combines vendor-native interaction, commercial PLC execution, closed-loop reduced-order process simulation, and independent outcome verification.<n>Results show that 98 episodes stop before a valid native read, whereas 62 reach a process-linked write but do not sustain the final objective.
• Score: 8.55906011630603
• License: http://creativecommons.org/publicdomain/zero/1.0/
• Abstract: Industrial control systems (ICSs) rely on programmable logic controllers (PLCs) to connect networked computation with physical control. Tool-using large language model (LLM) agents represent an emerging attack threat: can an autonomous agent convert a network-reachable PLC into sustained adverse physical impact? However, existing evaluations focus on digital tasks or individual stages of PLC testing. In ICSs, evaluations that stop at software exploitation, an accepted write, or tool access may therefore mischaracterize physical risk. We present PLCBENCH, to our knowledge, the first real-PLC hardware-in-the-loop (HIL) framework for characterizing this cyber-to-physical capability and its boundaries. It combines vendor-native interaction, commercial PLC execution, closed-loop reduced-order process simulation, and independent outcome verification. A deterministic evaluator applies fixed rules to runner, communication, PLC-object, and process records to assign six hidden diagnostic flags, distinguishing usable PLC interaction, process-linked manipulation, and sustained physical impact. We instantiate PLCBENCH on four commercial PLCs crossed with four closed-loop workloads. Across five LLM families and 240 real-PLC episodes, 75 episodes (31.3%) sustain their respective physical objectives. Stagewise results show that 98 episodes stop before a valid native read, whereas 62 reach a process-linked write but do not sustain the final objective. Notably, richer process observation is associated with an increase in conditional objective attainment after a process-linked write from 44.2% to 64.0%. These measurements localize failure in configured PLC-process deployments and identify intervention points for future defense evaluation. To support reproducibility, we release the safely disclosable PLCBENCH code and a software-only reproduction pipeline through the accompanying artifact.

Related papers

• LMSM: LLM Security Framework Inspired by Linux Security Modules [56.93644694627783]
  Large language models (LLMs) are increasingly deployed with layered defenses, yet malicious prompts can still bypass them.<n>We present Language Model Security Modules (LMSM), a security framework that adapts the separation behind Linux Security Modules (LSM) to LLM serving.
  arXiv  Detail & Related papers  (2026-08-26T12:13:05Z)
• PhyAgentOS: A Self-Evolving Operating System for Embodied Agents with Decoupled Cognitive Planning and Physical Execution [49.776611937968]
  We present PhyAgentOS, a foundation delivering scheduling, verification, memory, benchmarking, and safety as system-level services.<n>Its Session-Centered treats a session, not an action, as the minimum unit of scheduling, compatibility, supervised execution, evidence collection, and acceptance.<n>SessionVerifier distinguishes execution termination from semantic task completion via evidence-grounded verdicts of success, failure, or replan.<n> Benchmarking reuses the deployment session and verification path, so results trace to real execution.
  arXiv  Detail & Related papers  (2026-07-18T04:46:53Z)
• KS-CFA: Control-Flow Attestation via Symbolic Replay Against Control-Flow Bending Attacks [2.4632421150043573]
  We present KS-CFA, a new CFA scheme that detects CFB attacks across four transfer types without those costs.<n>The proving device records, inside a trusted execution environment (TEE), a control-flow trace and the external inputs that determine relevant run-time variables.<n>We implement and evaluate KS-CFA using the RISC-V Keystone TEE and Embench-IoT on QEMU and a Rocket-based FPGA platform.
  arXiv  Detail & Related papers  (2026-07-08T21:16:45Z)
• Understanding and Evaluating Claw-like Agent Security Through a Computer-Systems Lens [65.53494487819053]
  Claw-like AI agents (e.g., OpenClaw) are always-on processes with persistent access to credentials, files, tools, and external services.<n>We adopt a computer-system analogy: treating a Claw-like agent as an agentic computer system whose gateway runtime plays an OS-like mediation role.<n>We develop SafeClawArena, a benchmark of 406 adversarial tasks across four attack surfaces.
  arXiv  Detail & Related papers  (2026-06-29T18:00:45Z)
• RoboProcessBench: Benchmarking Process-Aware Understanding in Vision-Language Robotic Manipulation [59.10505906182782]
  Vision-language models (VLMs) are increasingly explored as visual critics, reward generators, and failure detectors in robotic manipulation.<n>Existing evaluations fail to test whether VLMs possess fine-grained process understanding.<n>We present RoboProcessBench, a benchmark for process-aware understanding in vision-language robotic manipulation.
  arXiv  Detail & Related papers  (2026-06-11T08:20:42Z)
• One Step Further: Understanding PLC Binaries Through Cross-Platform Reverse Engineering and Function-Level Semantic Analysis [7.990445011559295]
  PLC-BinX is a BCA workflow for cross-platform PLC binary understanding.<n>Under ten-fold program-level evaluation, PLC-BinX achieves 100.00% precision, recall, and F1 in toolchain prediction.<n>Results demonstrate that PLC-BinX provides an effective and interpretable approach to cross-platform PLC binary understanding.
  arXiv  Detail & Related papers  (2026-05-17T11:19:47Z)
• Stable Agentic Control: Tool-Mediated LLM Architecture for Autonomous Cyber Defense [0.0]
  Agentic systems involved in high-stake decision-making under adversarial pressure need formal guarantees not offered by existing approaches.<n>We present a tool-mediated architecture: LLM agents use deterministic tools and select from finite action catalogs enforced at the tool-output interface.
  arXiv  Detail & Related papers  (2026-05-04T18:02:59Z)
• CaP-X: A Framework for Benchmarking and Improving Coding Agents for Robot Manipulation [48.85772216740915]
  "Code-as-Policy" considers how executable code can complement data-intensive Vision-Language-Action methods.<n>We present CaP-X, an open-access framework for studying Code-as-Policy agents in robot manipulation.
  arXiv  Detail & Related papers  (2026-03-23T18:08:10Z)
• Robotic Grasping and Placement Controlled by EEG-Based Hybrid Visual and Motor Imagery [64.82869118243723]
  We present a framework that integrates EEG-based visual and motor imagery (VI/MI) with robotic control to enable real-time, intention-driven grasping and placement.<n>Motivated by the promise of BCI-driven robotics, this system bridges neural signals with physical control by deploying offline-pretrained decoders in a zero-shot manner.
  arXiv  Detail & Related papers  (2026-03-03T17:41:42Z)
• AutoPT: How Far Are We from the End2End Automated Web Penetration Testing? [54.65079443902714]
  We introduce AutoPT, an automated penetration testing agent based on the principle of PSM driven by LLMs. Our results show that AutoPT outperforms the baseline framework ReAct on the GPT-4o mini model.
  arXiv  Detail & Related papers  (2024-11-02T13:24:30Z)
• One for All and All for One: GNN-based Control-Flow Attestation for Embedded Devices [16.425360892610986]
  Control-Flow (CFA) is a security service that allows an entity (verifier) to verify the integrity of code execution on a remote computer system. Existing CFA schemes suffer from impractical assumptions, such as requiring access to the prover's internal state. We introduce RAGE, a novel, lightweight CFA approach with minimal requirements.
  arXiv  Detail & Related papers  (2024-03-12T10:00:06Z)
• Code Integrity Attestation for PLCs using Black Box Neural Network Predictions [6.328987417919762]
  We propose a practical code integrity checking solution based on privacy-preserving black box models. By exploiting the black box nature of the model, our solution maintains the privacy of the original PLC code. We evaluated our approach on a modern six-stage water treatment plant testbed, finding that it could predict actuator states from PLC inputs with near-100% accuracy.
  arXiv  Detail & Related papers  (2021-06-15T03:09:29Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.