Collaborative robots running vision AI are earning their first independent cybersecurity certifications just as researchers demonstrate that the software-agent layer those machines increasingly depend on can be hijacked with a text-repetition trick. ANALYSIS The convergence of these findings frames a problem the connected-factory sector has not yet priced in: hardening the hardware means little if the agent orchestration above it remains trivially exploitable.
Why it matters
Industrial cobots equipped with cameras and image-recognition algorithms are spreading through factory automation3. Those same cobots widen the attack surface once plugged into corporate networks. Separately, researchers from Pennsylvania State University, Université de Montpellier, and Dartmouth College showed that a technique they call "Repeat-After-Me" worked against LangChain's LangGraph, Microsoft Agent Framework, Microsoft's AutoGen, Google's Agent Development Kit 2.0, AWS' Strands Agents, and CrewAI1. "A seemingly benign text-repetition request thus gives the attacker direct control over the tool invocation and its arguments," the researchers wrote. ◆ If agent frameworks of this kind are adopted to coordinate cobot fleets or manage factory-floor decision-making, the trivial bypass demonstrated here becomes a pathway from a prompt to a physical actuator.
The big picture
Techman Robot secured IEC 62443-4-2 Security Level 2 certification for its TM AI Cobot S series, with testing firm DEKRA confirming the result in early October 2026. Techman describes itself as the first collaborative-robot manufacturer with integrated vision AI to reach that standard. IEC 62443 is an international framework governing the security of industrial automation and control systems, setting technical criteria meant to shield industrial networks from unauthorized access, tampering, and exploitable weaknesses. Techman said its lifecycle measures include defined workflows for vulnerability management, policies for reporting security incidents, and governed mechanisms for software and firmware updates. The company also said it intends to strengthen those measures further to meet the requirements of the European Union's Cyber Resilience Act, which requires manufacturers to monitor and remediate vulnerabilities continuously throughout a product's service life.
ANALYSIS That certification addresses the component layer: firmware, network interfaces, access controls on the robot itself. It does not, by design, cover the behavior of an upstream AI agent that might issue commands to such a component.
The Repeat-After-Me attack illustrates why that gap matters. In the demonstration, researchers asked an AI model to repeat text formatted as a tool invocation. The model initially refused but included the requested text in its response. The researchers then framed the request as hypothetical and instructed the model to reproduce only the supplied text; the model emitted a structured tool invocation, which LangGraph dispatched. A simulated tool returned a result before the model issued another refusal. The same research team's testing tool found verified security bugs in 118 of the 273 open-source Model Context Protocol servers it was able to run.
Between the lines
A parallel study from Northwestern University adds a second dimension to the reliability question. Researchers tested AI coding agents on 112 real security bugs drawn from 84 open-source projects written in C/C++, Go, and Rust2. With Claude Opus 4.7, about a third of the patches that stopped a crash still failed the tests the project's maintainers wrote for the fix. The authors call that kind of fix "strictly worse than no fix at all, since it tells you the problem is solved when it isn't".
ANALYSIS Applied to the factory context, the implication is twofold. First, agent frameworks that orchestrate cobot behavior can be subverted through prompt-level attacks that require no network penetration. Second, even when AI tools are enlisted to patch the vulnerabilities those attacks might exploit, the resulting fixes may mask rather than resolve the underlying flaw. Certifications like IEC 62443-4-2 SL2 address one layer of this stack; the agent and patching layers sit above it, currently uncovered by any comparable standard.
Techman's move toward the EU Cyber Resilience Act's continuous-remediation requirements gestures at the lifecycle problem. But that regulation is designed to harmonize cybersecurity rules for digital products broadly. ◆ It does not specifically address the scenario in which an AI agent, rather than a human operator, is the vector through which a certified device is compromised.
What's next
Techman's certification and its stated intent to align with the Cyber Resilience Act set a floor that other cobot manufacturers will face pressure to match. The Repeat-After-Me findings put six of the most widely deployed agent frameworks on notice to add output-validation layers that distinguish genuine tool calls from parroted text. The 118 verified bugs across 273 MCP servers suggest that the remediation backlog is already substantial. For factory operators evaluating AI-driven automation, the gap between a certified robot and a secure system now runs through the agent stack.