{"slug": "plcbench-can-autonomous-llm-agents-turn-plc-access-into-sustained-physical", "title": "PLCBench: Can Autonomous LLM Agents Turn PLC Access into Sustained Physical", "summary": "A new study introduces PLCBench, the first real-PLC hardware-in-the-loop framework for evaluating whether autonomous large language model (LLM) agents can convert network access to programmable logic controllers (PLCs) into sustained physical impact. Across 240 real-PLC episodes involving five LLM families and four commercial PLCs, 75 episodes (31.3%) achieved sustained physical objectives, while 98 stopped before a valid native read and 62 reached a process-linked write without sustaining the final objective. The researchers found that richer process observation increased conditional objective attainment after a process-linked write from 44.2% to 64.0%, identifying intervention points for future defense evaluation.", "body_md": "# Computer Science > Cryptography and Security\n\n[Submitted on 27 Aug 2026]\n\n# Title:PLCBench: Can Autonomous LLM Agents Turn PLC Access into Sustained Physical Impact?\n\n[View PDF](/pdf/2608.26882)\n\n[HTML (experimental)](https://arxiv.org/html/2608.26882v1)\n\nAbstract:Industrial control systems (ICSs) rely on programmable logic controllers (PLCs) to connect networked computation with physical control. Tool-using large language model (LLM) agents represent an emerging attack threat: can an autonomous agent convert a network-reachable PLC into sustained adverse physical impact? However, existing evaluations focus on digital tasks or individual stages of PLC testing. In ICSs, evaluations that stop at software exploitation, an accepted write, or tool access may therefore mischaracterize physical risk.\n\nWe present PLCBENCH, to our knowledge, the first real-PLC hardware-in-the-loop (HIL) framework for characterizing this cyber-to-physical capability and its boundaries. It combines vendor-native interaction, commercial PLC execution, closed-loop reduced-order process simulation, and independent outcome verification. A deterministic evaluator applies fixed rules to runner, communication, PLC-object, and process records to assign six hidden diagnostic flags, distinguishing usable PLC interaction, process-linked manipulation, and sustained physical impact. We instantiate PLCBENCH on four commercial PLCs crossed with four closed-loop workloads. Across five LLM families and 240 real-PLC episodes, 75 episodes (31.3%) sustain their respective physical objectives. Stagewise results show that 98 episodes stop before a valid native read, whereas 62 reach a process-linked write but do not sustain the final objective. Notably, richer process observation is associated with an increase in conditional objective attainment after a process-linked write from 44.2% to 64.0%. These measurements localize failure in configured PLC-process deployments and identify intervention points for future defense evaluation. To support reproducibility, we release the safely disclosable PLCBENCH code and a software-only reproduction pipeline through the accompanying artifact.\n\n### References & Citations\n\nLoading...\n\n# Bibliographic and Citation Tools\n\nBibliographic Explorer\n\n*(*[What is the Explorer?](https://info.arxiv.org/labs/showcase.html#arxiv-bibliographic-explorer))\nConnected Papers\n\n*(*[What is Connected Papers?](https://www.connectedpapers.com/about))\nLitmaps\n\n*(*[What is Litmaps?](https://www.litmaps.co/))\nscite Smart Citations\n\n*(*[What are Smart Citations?](https://www.scite.ai/))# Code, Data and Media Associated with this Article\n\nalphaXiv\n\n*(*[What is alphaXiv?](https://alphaxiv.org/))\nCatalyzeX Code Finder for Papers\n\n*(*[What is CatalyzeX?](https://www.catalyzex.com))\nDagsHub\n\n*(*[What is DagsHub?](https://dagshub.com/))\nGotit.pub\n\n*(*[What is GotitPub?](http://gotit.pub/faq))\nHugging Face\n\n*(*[What is Huggingface?](https://huggingface.co/huggingface))\nScienceCast\n\n*(*[What is ScienceCast?](https://sciencecast.org/welcome))# Demos\n\n# Recommenders and Search Tools\n\nInfluence Flower\n\n*(*[What are Influence Flowers?](https://influencemap.cmlab.dev/))\nCORE Recommender\n\n*(*[What is CORE?](https://core.ac.uk/services/recommender))# arXivLabs: experimental projects with community collaborators\n\narXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website.\n\nBoth individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them.\n\nHave an idea for a project that will add value for arXiv's community? [ Learn more about arXivLabs](https://info.arxiv.org/labs/index.html).", "url": "https://wpnews.pro/news/plcbench-can-autonomous-llm-agents-turn-plc-access-into-sustained-physical", "canonical_source": "https://arxiv.org/abs/2608.26882", "published_at": "2026-08-30 05:07:07+00:00", "updated_at": "2026-08-30 05:21:56.476575+00:00", "lang": "en", "topics": ["ai-safety", "ai-agents", "artificial-intelligence"], "entities": ["PLCBench", "arXiv"], "alternates": {"html": "https://wpnews.pro/news/plcbench-can-autonomous-llm-agents-turn-plc-access-into-sustained-physical", "markdown": "https://wpnews.pro/news/plcbench-can-autonomous-llm-agents-turn-plc-access-into-sustained-physical.md", "text": "https://wpnews.pro/news/plcbench-can-autonomous-llm-agents-turn-plc-access-into-sustained-physical.txt", "jsonld": "https://wpnews.pro/news/plcbench-can-autonomous-llm-agents-turn-plc-access-into-sustained-physical.jsonld"}}