Disclaimer: Passive reconnaissance only. No active testing, no credential attempts, no scanning beyond publicly indexed data collection. Findings reflect publicly accessible services as of August 2026. Endpoints may have changed status since discovery.
I was cruising the programs in the wilderness beyond the sports channels the other day and came across a classic horror film, "The Car." I sat and watched a possessed car terrorize a bunch of people who didn't know how to pop a tire. Okay, yes, I sat and made fun of it. But then I started thinking about autonomous technology in general. We see news about self-driving taxis and freight haulers and all sorts of other things. But how does this fold in to the OT world?
Then it hit me: Agriculture.
Spend any time around modern grain country and you notice something quiet but important. The combines still look like combines. The dryers still look like dryers. But the way they talk to the rest of the world has changed.
A high-capacity combine today is not just a big piece of iron with a lot of moving parts. It is a mobile industrial control system. Multiple electronic control units manage the engine, the hydraulics, the header, the threshing and cleaning systems, and the unload auger. Those controllers talk to each other over CAN and ISOBUS networks. RTK GPS keeps the machine on a path measured in centimeters. Yield and moisture data stream off the machine in real time. And sitting in the middle of all of that is a telematics gateway that phones home over cellular.
The same pattern shows up at the fixed sites that receive the grain. Dryers, elevator legs, bin monitoring systems, and load-out controls increasingly have their own cellular or IP-connected paths. Harvest does not end when the combine stops. The clock starts on moisture, capacity, and logistics the moment the grain leaves the field.
This is operational technology. It just happens to move across a field instead of sitting inside a fence line.
Precision agriculture and agricultural automation have moved from specialty tools to expected infrastructure in a relatively short time. Guidance and auto-steer are now routine on large row-crop operations. Telematics platforms from the major manufacturers are no longer optional add-ons; they are part of how fleets are managed, how dealers support machines, and how data moves from the field into farm management systems.
Autonomy is commercializing in stages. Tillage came first because the job is more constrained. Harvest is harder — more variables, tighter timing, higher consequences if something goes wrong. But the direction of travel is clear.
Labor pressure in developed markets is not going away. And the harvest window does not expand to accommodate it.
The result is that a growing share of the calories moving through major food systems now depends on machines that are networked, remotely visible, and in some cases remotely influenceable.
If you work in OT, the stack is easy to recognize once you stop thinking of it as "farm equipment."
The ECUs and sensors on the machine are the field devices. CAN and ISOBUS are the fieldbuses. The guidance controller is a specialized process controller. The telematics unit is the remote terminal unit or cellular gateway. The cab display is the local HMI. The manufacturer's cloud platform is the SCADA and historian layer rolled together.
The closest parallel many of us have seen recently is the cellular-connected equipment at remote water and wastewater sites. In the Minnesota events of July 2026, attackers reached controllers at water towers and lift stations that relied on cellular links. Several utilities said the impact was limited to equipment on those cellular paths. They recovered by disconnecting the links and switching to manual operation.
Agricultural telematics gateways sit in the same architectural position. They are the bridge between a public network and a real-time control system.
The difference is that the control system is often moving at ten miles an hour through a field of corn.
I ran a set of focused passive searches looking for the kinds of markers that would identify agricultural machinery and processing equipment on the public internet. The results were clarifying.
Tractors and combines themselves essentially do not appear as internet-reachable hosts. The major OEM telematics systems resolve almost entirely to cloud endpoints. John Deere's telematics cloud alone accounts for well over a thousand endpoints, the large majority sitting on Amazon infrastructure. The field units initiate outbound connections. They are not listening for inbound ones.
That is different from the classic water-sector pattern where cellular-connected PLCs or RTUs sometimes sit more directly on reachable paths.
What does show up is the concentration point. The reachable surface for large numbers of machines has moved into the manufacturer cloud platforms. Those platforms are the aggregation and supervisory layer. A problem there is fleet-scale by design.
The one clear piece of process equipment that appeared was a grain dryer controller reachable on Telnet with only a login prompt. No further interaction was performed. Grain drying sits on the critical path between harvest and storage. When drying or handling capacity is disrupted during peak intake, the bottlenecks and spoilage risk appear quickly.
A small number of Ntrip servers also appeared. These broadcast the differential corrections that give precision equipment its accuracy. They are not exclusive to agriculture, but modern auto-steer and higher levels of autonomy depend on them.
The practical picture is this: individual machine takeover from the public internet is uncommon. Fleet-wide loss of telemetry, guidance services, remote support, or supervisory functions through the shared cloud layer is the more realistic high-impact scenario. The cellular bridge still exists. For the mobile fleet it has simply been abstracted into vendor cloud services. The systemic risk did not disappear; it concentrated.
The productivity case is real. Overlap drops. Fuel use drops. Operator fatigue drops. Machines can run longer hours inside the weather windows that actually exist. Data that used to live only in the operator's head or on a clipboard now moves into systems that can improve decisions across seasons.
On large operations, one experienced person can supervise more iron than was previously practical. That is not a small thing when the labor pool is constrained.
The internal buses were designed for interoperability. Authentication was not the primary goal. Once an attacker is on the CAN or ISOBUS network, the usual OT problems apply.
Diagnostic paths often inherit the same weak patterns seen on other heavy equipment. Telematics gateways vary in how carefully they are segmented from the control network and how strongly they authenticate.
Shared configurations and common platforms create concentration risk. When many machines depend on the same cloud service or the same gateway models, a single problem can affect a region rather than a single farm.
And harvest is not like a factory that can idle. Grain left in the field has a short, unforgiving window. Quality drops. Losses rise. The downstream system feels it quickly.
A single combine that drifts into the wrong field is a local problem. Recoverable, expensive, embarrassing, but local.
The more serious cases sit further downstream.
Miss the optimal harvest window across enough acres and the losses compound. Grain still has to move to elevators and dryers. If those fixed sites lose automated control or visibility at the same time — whether through the same cellular patterns or through capacity overload — the bottlenecks appear fast. Trucks back up. Moisture problems multiply. Storage decisions get worse.
Modern food logistics run lean. Disruptions at the production edge move into processors, packers, and distributors more quickly than most people outside the sector expect. We have already seen ransomware events against major processors demonstrate how fast availability problems travel. An earlier disruption at the harvest and handling layer simply moves the starting point upstream.
There is also the regional concentration problem. When many operations share the same telematics platform or the same integrator practices, the blast radius grows. That is the operational signature of the Minnesota water campaign: not one exotic zero-day, but scalable access to similarly configured remote assets. In agriculture the concentration has moved into the cloud layer that sits above thousands of machines.
Secondary effects follow. Feed availability for livestock. Export timing. Price volatility in the affected commodities. Pressure on already thin rural service networks.
Automated harvesting and processing are not experimental curiosities. They are becoming the operating system of large-scale food production in places where labor is constrained and the weather does not wait.
The productivity argument is strong. The security architecture is still catching up. For the mobile fleet, the reachable surface has largely moved into manufacturer cloud platforms. For the fixed handling sites, older patterns of direct exposure still appear. In both cases the cellular bridge remains a critical path between a public network and real-time control.
The Minnesota water incidents showed what happens when remote cellular-connected OT is treated as an afterthought. Agriculture now runs a mobile, seasonal, high-consequence version of the same pattern. The output is not water pressure. It is the timing and volume of the food supply itself.
We do not need to stop autonomy. We do need to treat the telematics bridge, the diagnostic paths, the shared cloud dependencies, and the post-harvest handling systems with the same seriousness already applied to other critical infrastructure. The harvest window will not wait for a retrofit.
So, will we see a possessed harvester terrorize a small town? Probably not, but I'd watch the movie. What do we see? How will we protect it?
OTFeed — Pick the vendors in your environment, get alerts when something hits them. 3,993 OT advisories tracked. Start your free 30-day trial →