The increasing integration of AI agents into cyber-physical systems (CPS) introduces new security risks that extend beyond traditional cyber or physical threat models. Recent advances in generative AI enable deepfake and semantic manipulation attacks that can compromise agent perception, reasoning, and interaction with the physical environment, while emerging protocols such as the Model Context Protocol (MCP) further expand the attack surface through dynamic tool use and cross-domain context sharing. This survey provides a comprehensive review of security threats targeting AI agents in CPS, with a particular focus on environmental interactions, deepfake-driven attacks, and MCP-mediated vulnerabilities. We organize the literature using the SENTINEL framework, a lifecycle-aware methodology that integrates threat characterization, feasibility analysis under CPS constraints, defense selection, and continuous validation. Through an end-to-end case study grounded in a real-world smart grid deployment, we quantitatively illustrate how timing, noise, and false-positive costs constrain deployable defenses, and why detection mechanisms alone are insufficient as decision authorities in safety-critical CPS. The survey highlights the role of provenance- and physics-grounded trust mechanisms and defense-in-depth architectures, and outlines open challenges toward trustworthy AI-enabled CPS.

翻译：人工智能代理在网络物理系统中的日益集成引入了超越传统网络或物理威胁模型的新型安全风险。生成式人工智能的最新进展使得深度伪造和语义操纵攻击成为可能，这些攻击可能损害代理对物理环境的感知、推理与交互能力；而诸如模型上下文协议等新兴协议通过动态工具使用和跨领域上下文共享进一步扩大了攻击面。本文对针对网络物理系统中人工智能代理的安全威胁进行了全面综述，特别聚焦于环境交互、深度伪造驱动的攻击以及模型上下文协议介导的漏洞。我们采用SENTINEL框架对文献进行系统梳理，该框架是一种生命周期感知的方法论，集成了威胁特征刻画、网络物理系统约束下的可行性分析、防御策略选择以及持续验证。通过一个基于现实世界智能电网部署的端到端案例研究，我们定量阐述了时序、噪声和误报成本如何制约可部署的防御措施，并阐明了为何在安全关键的网络物理系统中仅依赖检测机制作为决策权威是不充分的。本综述强调了基于溯源和物理原理的信任机制以及纵深防御架构的作用，并展望了构建可信人工智能赋能网络物理系统所面临的开放挑战。