The report
When an attacker-controlled agent expects a machine to obey a destructive command, a defender can refuse the effect without revealing that refusal. Talos studied a gateway that evaluates commands and redirects suspicious traffic to a mirrored Modbus controller. The hostile agent observes apparent progress and can reveal additional intent, while the simulated real plant remains behind a separate hard constraint. The paper reported zero unauthorized writes reaching the protected simulated plant over 2,400 adversarial-agent episodes.
Deception and independent enforcement are different controls
The researchers tested four disclosure settings with 600 agents apiece, using the same attacking model and destructive objective. The agents initiated reads and then issued many attempted writes, most of which used an extreme target value. The mirror was useful for continuing observation of the attacker's choices. But a device-level rule still checked residual commands independently of the language model. Consequently, the zero harmful-write result cannot be attributed entirely to an AI classifier or to the attacker being fooled.
The claimed effect also has a precise denominator. These were synthetic agents and a synthetic controller, not 2,400 identified industrial intruders or installations. No production telemetry establishes how often legitimate maintenance would be mistakenly quarantined, whether mirror responses remain believable across complex processes, or how timing and plant safety constraints behave under network loss. The Talos Case retains those unanswered questions.
The defensible lesson is about where authority sits. An untrusted agent's self-description does not establish permission to change a controller, and a model-based review should not replace the final device-level command boundary. Real hardware tests must independently measure both blocked hostile effects and false denials of necessary operator work.