# OT AI-Uplift Exposure Assessor

> OT AI-Uplift Exposure Assessor is a paid API for AI agents from ot-intel-api.onrender.com, paid per call via x402, $0.2/call, status unknown (last checked 2026-09-14).

Assesses how much a general-purpose AI agent lowers the barrier for an attacker to reach a vendor's OT/ICS-adjacent footprint, returning a tiered exposure verdict grounded in ICS threat intelligence.

## Facts

- Endpoint: GET https://ot-intel-api.onrender.com/ot/ai-uplift
- Price: $0.2/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/ot-ai-uplift-exposure-assessor-9dc14b00
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_8GOrwWDQpnkmq_KwJOUav

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability ot-ai-uplift-exposure-assessor-9dc14b00
```

Example prompt: What's the AI uplift exposure risk for Schneider Electric — the OT environment is internet-facing, uses single-factor auth, and is not segmented from the IT network?

## When to prefer this

Use this endpoint when you need to understand specifically how general-purpose AI agent capabilities (not specialized ICS tools or the vendor's own AI copilot) change the attacker's ability to reach an OT/ICS vendor's footprint. Prefer this over /ot/ai-exposure (which assesses the vendor's own AI copilot risk) and over generic OT risk endpoints when the threat question is AI-mediated attack uplift. Best suited for OT security analysts, red teamers, and cyber risk teams evaluating AI-era threat posture for specific ICS vendors.

## Known failure modes

- Missing required 'vendor' parameter returns 400 or informational-only result
- Unknown or misspelled vendor name may return a generic or uncalibrated assessment
- All optional parameters left as unknown caps the exposure tier deterministically at 'informational', limiting usefulness
- Ambiguous or unsupported auth_type values may default to 'unknown' behavior
- Service hosted on render.com free tier may experience cold-start latency or downtime
- DeepSeek synthesis may produce inconsistent results for niche or obscure vendors

## How this service works

Assesses how much a general-purpose AI agent (not a specialized ICS tool) lowers the barrier for an attacker to reach a vendor's OT-adjacent footprint. Grounded in Dragos's May 2026 water-utility precedent, not governance thresholds. Distinct from /ot/ai-exposure (vendor's own AI copilot). Input: vendor (required); product, internet_facing, auth_type, segmented (all optional; unknown caps tier at informational). DeepSeek-synthesized, ICD-203 language.

## Output

Returns a tiered AI uplift exposure verdict (e.g. informational, low, moderate, high, critical) indicating how much a general-purpose AI agent lowers the attack barrier for the specified OT vendor's footprint, with ICS threat context grounded in Dragos's May 2026 water-utility precedent and ICD-203 language. If optional parameters are omitted, the tier is capped at 'informational'.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [],
     "properties": {
      "vendor": {
       "type": "string",
       "description": "OT/ICS vendor name e.g. Schneider Electric, Siemens, Rockwell Automation. Required — at least this param must be present."
      },
      "product": {
       "type": "string",
       "description": "Optional product line filter e.g. Modicon, SIMATIC."
      },
      "auth_type": {
       "type": "string",
       "description": "Optional. single-factor, mfa, or unknown (default)."
      },
      "segmented": {
       "type": "string",
       "description": "Optional. Is OT segmented from IT: true, false, or unknown (default). If internet_facing, auth_type, and segmented are all left unknown, the exposure tier is deterministically capped at 'informational'."
      },
      "internet_facing": {
       "type": "string",
       "description": "Optional. Is the OT-adjacent asset internet-reachable: true, false, or unknown (default)."
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "tlp": "TLP:CLEAR",
  "vendor": "Schneider Electric",
  "product": "Modicon",
  "summary": "Modicon PLC line has documented CVEs with public exploit context and no MFA on the management interface; no direct AI-assisted-targeting precedent yet found in the corpus for this vendor.",
  "confidence": "moderate",
  "recommendations": [
   "Enforce MFA on all remote engineering access",
   "Monitor for password-spray patterns against gateway interfaces"
  ],
  "ai_exposure_tier": "moderate",
  "known_precedents": [],
  "compensating_controls": [
   "Restrict engineering workstation access via allowlisting",
   "Segment Modicon management VLAN from general IT"
  ],
  "deployment_context_used": {
   "auth_type": "single-factor",
   "internet_facing": "true",
   "segmented_from_it": "false"
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/ot-ai-uplift-exposure-assessor-9dc14b00/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from ot-intel-api.onrender.com](https://www.zero.xyz/host/ot-intel-api.onrender.com/llms.txt)