4 Things Industry 4.0 07/13/2026

Two security stories landed this month that look unrelated. They're not. Both are about systems that trust input they shouldn't—one brand new, one older than your maintenance supervisor.

Let's start with the new one. Researchers at Noma Security pulled off an attack they call GitLost, and the method is almost insulting in its simplicity.

The details:

• They planted a booby-trapped "issue" in a public GitHub repository. When GitHub's AI agent read it, the hidden instructions told it to go fetch README files from private repos and paste them into a public comment for anyone to see.
• GitHub had guardrails against exactly this. The bypass? A single transition word: "Additionally." That was enough to slip the malicious command past the filter. This trick is called prompt injection—hiding instructions inside content the AI is only supposed to read, not obey.
• Meanwhile, CISA (the federal cybersecurity agency) spent early July doing its usual unglamorous work: publishing batch after batch of ICS advisories—warnings about exploitable flaws in the industrial control systems that run plants. Six advisories on July 2nd alone, with more the following week. Same story, every single week.

Why it matters for manufacturing:

Here's the thread connecting them. Prompt injection is to an AI agent what an unpatched PLC is to your network: a door you didn't know was standing open.

The AI copilots your team is piloting read tickets, emails, sensor logs, and vendor PDFs. Every one of those is a place an attacker can tuck a "just also do this" instruction. And the OT side—your programmable logic controllers (PLCs), operator screens, and SCADA systems—has always had this problem. It just never had a trendy buzzword attached to it.

Real-world scenario: Your maintenance team wires up an AI assistant to read work orders and pull the right equipment manuals automatically. Slick. Then someone submits a work order with a hidden line telling the agent to quietly export your historian credentials. The agent was built to be helpful. It has no idea it's being played.

The bottom line: New tools, same old lesson—never let a system act on input you haven't validated, whether that system is a 2005-vintage PLC or a 2026 AI agent. Give both the least access they need to do the job, and audit what they actually touch.

👉 Read the GitLost writeup from Noma Security
👉 Check CISA's latest ICS advisories

Follow the Money: What $5 Billion Deals Reveal About Your Plant's Future

If you want to know where manufacturing is actually heading—not where the conference keynotes say it's heading—watch where the acquisition money goes. PwC's latest Industrial Manufacturing Deals Outlook just dropped, and the checkbook is talking.

The details:

• The mega-deals are back. A striking 52% of all deal value now comes from transactions over $5 billion—up from a single megadeal accounting for just 18% of annual value the year before. Translation: companies aren't nibbling anymore, they're making franchise-level bets.
• AI and automation are the thesis. Buyers aren't chasing factories for their square footage. They're paying up for AI-enabled manufacturing execution systems (MES), predictive maintenance platforms, and robotics. Digital capability is the valuation now.
• Policy is steering the capital. Tariffs, trade realignment, and clean-energy incentives are pushing money toward domestic and diversified manufacturing. Where you build is becoming as strategic as what you build.
• PwC's Michael Fiore put it plainly: "Industrial M&A momentum has returned."

Why it matters:

Here's the part that should get your attention. The valuation gap between digitally-advanced plants and everyone else is widening—fast.

When acquirers pay a premium for predictive maintenance and connected data, they're repricing the whole market. The shop still running on spreadsheets and tribal knowledge isn't just less efficient—it's worth less on paper. Digital maturity moved from "nice-to-have" to "line item on the balance sheet."

Real-world scenario: Two plants, same output, same town. One has a unified namespace, live OEE dashboards, and a maintenance model that flags failures before they happen. The other has a really experienced guy named Dave who "just knows" when Line 3 sounds off. When the private-equity buyer walks both floors, guess which one earns the premium—and which one gets the "we'll need to invest heavily post-close" discount?

The bottom line: You don't have to be for sale to care about this. The same things that make a plant acquirable make it competitive—connected data, AI-ready systems, and a digital foundation you can actually build on. The money is voting. Vote with it.

👉 Read PwC's Industrial Manufacturing Deals Outlook

Why the Smartest AI in Your Plant Won't Be a ChatGPT Clone

Everybody's racing to bolt a large language model onto the factory—ask it about your downtime, your yield, your maintenance schedule. It's a natural instinct, and it hits a wall fast.

Here's the thing: ChatGPT and its cousins learned the internet. Words, articles, code. Not one of them has ever watched a distillation column drift out of spec at 3 a.m. They're fluent in language and clueless about your process.

The details:

• A different class of model is emerging—call them industrial foundation models. Instead of training on text, they train on what your plant actually produces: time-series sensor data. Temperatures, pressures, flows, vibration—millions of tags over time.
• The clearest example is Chinese automation giant SUPCON's TPT, short for "Time-series Pre-Trained Transformer." Note what it's not: an LLM. The newer TPT2 uses a Mixture-of-Experts design—picture a bench of specialists where the model calls in the right one for each job.
• Per IoT Analytics, models in this class are trained on data from 1,000+ plants—so they show up already knowing how industrial processes behave instead of starting from a blank page.
• And it's not vaporware. At a Lanzhou petrochemical site, SUPCON reports 99.79% anomaly-prediction accuracy, a 4–5 hour cut in furnace heat-up time, and a +0.373% ethylene yield per furnace—which adds up to real money at that scale.

Translation: A general AI can write you a poem about your reactor. A purpose-built industrial model can help you run it.

Why it matters:

The prize here is closed-loop optimization—AI that reads live plant data and writes better setpoints back into the control system, continuously, without a human babysitting every move. That's a genuinely different animal from a chatbot that makes suggestions and waits.

Real-world scenario: Your maintenance supervisor asks, "why did Line 2's motor current creep up last Tuesday?" A text model guesses from general knowledge. A time-series model that's seen a million motor-current curves recognizes the early signature of bearing wear—and tells you how many days you've got.

The pitfall to watch: Vendors love the word "AI." SUPCON's own press releases are thin on hard numbers and thick on buzzwords—the credible parts are the deployment case studies, not the marketing copy. When someone pitches you an industrial model, ask one question: "Show me the plant, the metric, and the before-and-after." No numbers, no deal.

The bottom line: The future of AI on the plant floor probably isn't the model everyone's chatting with at dinner. It's a quieter, narrower one trained on the language your equipment already speaks.

👉 SUPCON's TPT announcement
👉 The Hannover Messe trends behind industrial foundation models (IoT Analytics)

A Word from This Week's Sponsor

From MQTT Messages to AI Actions — Live With EMQ Today

Today, Monday, July 13 at 12:00 PM CDT, Walker sits down with Ivan Dyachkov (Field CTO, EMEA at EMQ) and Brandon Ruiz (Product Marketing Manager) for "Beyond the Broker: The Vision for AI-Driven IoT Operations." Streaming live on LinkedIn and YouTube.

Most of you know EMQX as the MQTT broker shuttling your plant-floor messages around. This conversation is about where they're taking it next—past pure connectivity and into AI-driven IoT operations.

Two new capabilities anchor the discussion (both currently in private beta on EMQX Cloud):

• EMQX Agents — an event-driven agent runtime that wires AI directly to your MQTT events, historical data, and device state. Think alarm triage, predictive maintenance, and OTA rollouts, with the agent reasoning over live context, asking for human approval when it matters, and publishing commands back through the broker.
• EMQX Fleets — the device-management layer: a unified registry, real-time device shadows, fleet-wide queries, jobs, and diagnostics for teams wrangling thousands of connected devices instead of babysitting them one at a time.

The throughline is one we hammer on constantly: connectivity is the nervous system, but the real value shows up when you can manage state, apply context, and close the loop from event → decision → action. And fair warning for the skeptics—Walker's going to press hard on the guardrails: how you keep an AI agent from firing the wrong command at real equipment.

👉 Join the livestream today at 12 PM CDT on LinkedIn / YouTube
Learn more: EMQX Agents · EMQX Fleets

Securing MCP: The Plumbing Behind Your AI Just Got a Security Manual

We talk about MCP—the Model Context Protocol—a lot around here, because it's quietly becoming the standard way to plug AI into everything else. Think of it as a USB-C port for AI agents: one connector that lets a model reach into your databases, historians, ticketing systems, and tools.

That's exactly what makes it powerful. It's also exactly what makes it a target. Every MCP server you stand up is a new door into your systems—and this summer, the folks whose whole job is doors started paying attention.

The details:

• The NSA and CISA jointly published security guidance for MCP in June, right alongside the official MCP project's own security best practices and a practical OWASP guide for developers. When the NSA writes a manual for your plumbing, it's officially mainstream.
• The threats are the ones you'd expect once an AI can act, not just answer: prompt injection (remember Article 1?), over-privileged access tokens that hand an agent the keys to the whole building, "tool poisoning" where a malicious server description quietly tricks the model, and unauthenticated servers anyone on the network can talk to.

Why it matters for manufacturing:

Connect an AI agent to your MES, your historian, or your Unified Namespace through MCP and you've built something genuinely useful—an assistant that can read state and take action. You've also built a shortcut an attacker would love. The governance you'd demand of any human operator with that much access should apply to the agent, too.

Real-world scenario: You spin up an MCP server so your AI copilot can query the historian. Handy. But you gave it a token with write access "just to be safe," and left the server open on the plant network. Now anyone who reaches it—or any poisoned input the agent happens to read—can do everything that token allows.

The starter checklist (straight from the guidance):

• Least privilege—give each MCP server the narrowest access that does the job, read-only wherever you can.
• Authenticate every server. No anonymous endpoints sitting on your network.
• Keep a human in the loop for any command that touches physical equipment.
• Validate and sandbox inputs, and log everything the agent does so you can replay it later.
• Vet third-party MCP servers like the supply-chain risk they actually are.

The bottom line: MCP is going to be the connective tissue of industrial AI. Wire it up the way you'd wire up anything else with access to your plant—assume it'll be attacked, and give it the least it needs.

👉 NSA/CISA guidance on securing MCP
👉 Official MCP security best practices

From the Floor: This Week in the Community

Back for round two of From the Floor, and the Discord didn't disappoint—if anything, it got louder. Deep technical brawls, new tools, and a healthy amount of poking at manufacturing's sacred cows. Here's what you missed if you weren't lurking.

Sacred cows got grilled. A thread in #💬-general (July 8) took aim at legacy practices and vendor lock-in, using the proprietary CFX format in natural gas as exhibit A for why open standards win. The pile-on continued in #🔗-content-links, where a shared LinkedIn piece asked the question nobody at the ISA booth wants to hear: is ISA-95 still relevant?

Ignition + AI stole the show. The #ignition channel was on fire. Ectobox dropped a preview of new modules (including a tool called ScripTide) and asked for feedback. RudyV0700 walked through practical AI agents for Ignition development—with a refreshing focus on stopping the hallucinations instead of pretending they don't happen. And a new explainer on Ignition 8.3's Historian API got a warm reception.

The protocol nerds came out to play. Over in #opc-ua (July 12), members debated whether modern APIs are quietly tossing out one of OPC UA's smartest design choices—the separation of DataType and ValueRank. Meanwhile #mqtt compared open brokers like MonsterMQ and started sketching the wishlist for an "Industrial Data Explorer" to replace the tools we've all outgrown.

AI/ML, minus the hype. In #ai-and-ml, the conversation stayed grounded: how do CDMOs adopt AI without exposing client IP? (Spoiler: trust is the hard part.) And a thoughtful thread put "Skynet" fears to bed while raising the actually valid concern—surveillance, not sentience.

Wins & new faces. Monday and Friday "Wins" delivered: data center migrations, a finished SAP Tulip integration, new equipment coming online. We also welcomed an OT Systems Engineer from Philly and an OT consultant working mission-critical data out of Saudi Arabia. 👋

Jump into these open threads:

• #opc-ua: Are modern APIs throwing away OPC UA's design advantages?
• #mqtt: What would it take to finally replace MQTT Explorer?
• #mastermind: How's FrameworX holding up—its AI features vs. the manual-change experience?
• #💬-general: Anyone running Handling Units with MES & SAP EWM? (And: got a live supply-chain project an MBA student in the community could sink their teeth into?)

Not in the room yet? Come hang out in the Discord → — that's where the real work gets argued out.

Byte-Sized Brilliance 

The Protocol Running Your Smart Factory Was Built to Pinch Pennies in the Desert

Fitting one this week, with EMQ on the show. MQTT—the messaging protocol quietly moving data across millions of plant floors—was invented back in 1999. Not for AI. Not for Industry 4.0. For an oil pipeline.

Dr. Andy Stanford-Clark of IBM and Arlen Nipper built it to monitor a SCADA pipeline stretched across the desert, phoning home over expensive, painfully slow satellite links. Every byte cost money and battery life. So they designed the leanest protocol they could—tiny headers, minimal handshakes, publish-and-subscribe—to squeeze telemetry through a straw.

Twenty-six years later, that same penny-pinching design is exactly why MQTT won. The trait that made it perfect for a bandwidth-starved pipeline—ruthless efficiency—makes it perfect for a plant with 50,000 sensors, an edge gateway, and an AI agent waiting on the other end. The world around it got a thousand times more powerful. The protocol barely had to change.

And there's a lesson in there for all the shiny new stuff we cover every week. The tools that last aren't the flashiest—they're the ones built to do one thing so well they're still standing when the hype cycle rolls on. Your unified namespace is riding on a 1999 idea about how to talk to a pipe. And it's still the right call.

Let us know how we're doing! https://forms.gle/zSXrKTK9BNZ3BrpXA