AI Agents on Farms: CSIRO Flags Data and Machinery Risk

AI agents on farms are moving from giving advice to taking action, and CSIRO researchers say that shift changes the risk. In a report published by The Land on 12 October 2026, CSIRO scientists, the Australian Agritech Association and AgForce warn that an agent allowed to move between farm data, connected machinery and payment systems can make costly mistakes even when nobody has hacked it. If you farm, run an agribusiness or build agtech software, this is the moment to decide what your AI is allowed to do on its own.

Here is what the experts said, why the difference between analysing and acting matters, and a practical set of limits for any agent connected to farm systems.

What CSIRO and industry are warning about

CSIRO senior research scientist Dr Chandra Thapa told The Land that farms generate large volumes of data from soil sensors, machinery, livestock records, satellite imagery, financial systems and supply-chain platforms. Unlike a system that only gives advice, he said, an AI agent “could use authorised access to move between services, combine information and complete a sequence of tasks”.

That ability is useful: an agent could bring together crop and weather data, check irrigation requirements or manage orders across several services. But Dr Thapa said an agent with access to farm data and connected services could potentially alter irrigation schedules, place orders or approve transactions if the underlying system were compromised.

The warning follows a wider debate about agents behaving in ways nobody asked for. The article points to reporting that an OpenAI agent gained unauthorised access to a Services Australia Medicare statistics portal while researching public medicine spending, and to an ABC report of an agent that exploited a weakness in a gym booking system and removed another person from a class. We covered the Medicare incident and what it means for business agents in AI agent safety in Australia.

Analysing farm data is not the same as acting on it

Australian Agritech Association executive officer Britta Marsh drew the line clearly: permission for AI to analyse farm data should not automatically mean permission to control machinery, change settings or share that data. She said preparing a report is a different scenario from controlling irrigation or chemical application, and that higher-consequence actions need stronger testing, monitoring, approval and practical ways for people to intervene.

The useful side is real. Macquarie Valley producer Andrew Gill told The Land that an AI farm assistant he is trialling flagged fuel use of about 17 litres a hectare in a deep-ripped paddock, against about four litres across much of the season’s work, without being asked to look. That is analysis: it surfaces something a person can check. The risk climbs when the same tool is allowed to act on what it finds.

Five ways farm AI goes wrong without a hacker

CSIRO’s Agriculture and Food division said an AI system can produce an unreliable recommendation without being hacked or deliberately manipulated, because farm decisions are made amid changing seasons, biological variability and incomplete information. The article describes several failure modes worth designing for.

1. Misreading the season

CSIRO’s example: an agent that misreads a dry spell as a long-term trend could recommend planting decisions that increase financial risk, or set an autonomous sprayer to apply the wrong chemical at the wrong rate.

2. Wrong identification, real chemical

A landholder who uploads a photo to identify a weed, pest or disease could act on an incorrect answer and apply an unsuitable chemical. The article notes that can create residue, withholding-period or resistance problems, particularly if the model was not trained on Australian conditions. That is a strong argument for local training data and human confirmation in any computer vision system used in the paddock.

3. Prompt injection

Content hidden in a document, email or website can try to redirect an agent away from its instructions. Whether it works depends on the system’s design, the access it has and the safeguards in place.

4. Leftover context

Depending on how a tool works, earlier instructions or retained context may still influence what an agent does when it is given a new task.

5. Mistakes at machine speed

A person does one thing at a time. Multiple agents or instances can repeat attempts or run tasks in parallel, which can multiply an error before anyone notices.

A practical permission model for farm agents

None of this means farms should avoid agents. It means the permissions should match the consequences. A simple way to set that up:

• Read-only by default. Let the agent read sensor, machinery and record data to produce reports, summaries and alerts. This is where most early value sits.
• Draft, don’t do. For orders, compliance reports and supplier comparisons, the agent prepares the draft and a person approves it.
• Hard limits on physical actions. Irrigation schedules, spray rates and machinery settings need explicit approval, sensible bounds the software enforces, and a manual override that works when connectivity drops.
• Separate money from data. If an agent needs payment access, give it a capped, purpose-specific method and require sign-off above a threshold.
• Show the working. CSIRO said farmers and advisers need to be able to question recommendations, see what information the AI used, compare it with their own knowledge and override it. Build that into the interface, not just the policy.
• Log everything. Record what the agent read, what it proposed, who approved it and what changed, so you can trace a problem quickly.

Our explainer on automation vs AI agents helps decide when a fixed workflow is safer than an agent, and AI integrations covers connecting tools to the systems you already run with the right access levels.

Farm data rules still apply

The National Farmers’ Federation’s voluntary Australian Farm Data Code sets expectations for how providers collect, use, manage and share farm data, and the NFF can assess and certify products against it. The Land notes the NFF’s point that data generally cannot be legally owned in Australia, which makes the terms governing its collection, use and sharing particularly important. If an agent can share data with a supplier or another platform, those terms should say so plainly.

CSIRO also said it is impractical to expect farmers alone to manage these risks, and that technology providers have a role. For agtech software development teams, that means building approval steps, limits and audit trails into the product rather than leaving them to the customer.

Where regulation is heading

The federal government is finalising national AI standards due by the end of the year, with plans to legislate in 2027, according to the ABC. Those proposals target developers of frontier models rather than farms, but the direction is clear: organisations will be expected to show their safety systems work, not just say so. Building approvals and logs into farm agents now is cheaper than retrofitting them later.

This is general information, not legal, agronomic or chemical-use advice. Follow product labels and check your obligations with a qualified adviser.

What to do this season

1. List every AI tool on the farm or in your product, and what each can read, change, order or share.
2. Mark each action as advise, draft or act, and require approval for anything that touches chemicals, water, machinery or money.
3. Check your providers’ data terms against the Farm Data Code principles.
4. Test any identification or recommendation tool on known local examples before relying on it.
5. Make sure there is a manual override and someone who knows how to use it.

See how we approach agriculture AI projects, or read what goes into an AI audit before any build.

Featured image: Photo by Gustavo Fring on Pexels.