Neuro-Agentic Control Secures Industrial IoT with LLM and TimesFM.

A new "neuro-agentic control framework" has been developed to address the growing threat of cyberattacks on operational technology (OT) in industrial IoT environments. Traditional rule-based monitoring struggles with the complexity of these attacks, while Large Language Models (LLMs), despite their reasoning abilities, pose safety risks due to their potential for hallucinations in closed-loop control. This innovative architecture couples an LLM-based planner, such as Gemini 2.5 Flash-Lite, with a pre-trained Time-Series Foundation Model (TimesFM). The core innovation is a "Counterfactual Physics Injection" mechanism. This mechanism simulates the impact of any LLM-proposed intervention within the numerical latent space of the foundation model *before* actual actuation, allowing the system to reject unsafe or hallucinatory actions. Evaluated on an industrial dataset (SWaT) under stochastic attack scenarios, the framework significantly outperformed LSTM and TCN baselines. It prevented a higher percentage of breaches with zero physically invalid actions executed, demonstrating the effectiveness of using foundation models as deterministic "Sentinels" to safeguard agentic AI in critical infrastructure.