Skip to content
MoorAI
Get MoorAI
MoorAIJournal
On this page
Why isolated sites are moving tolocal modelsWhat stillcrosses the gapA hardening checklist fora local-LLM enclaveWhere eachMoorAI partfitsSources
// blog · operator’s guide

Local LLMs and AI agents in air-gapped OT: the gap stops the cloud, not the agent

Plants, utilities and defence sites are running models on their own hardware. What still crosses the gap, a hardening checklist for a local-LLM enclave, and where each MoorAI part fits.

MoorAI October 21, 2026 ~6 min read MoorAI
Diagram titled Local LLMs in air-gapped OT: the gap stops the cloud risk, and what still crosses it is checked at each step. A transfer station runs moorai-model-scan on pickle, PyTorch, GGUF, ONNX, Keras, TensorFlow and SafeTensors files, read and never loaded, with a sha256 per file, then the files cross on removable media into the local-LLM enclave, which has no cloud. Inside the enclave, workstations run MoorAI for Agents, which checks each command, file read and tool call before it runs; the model proxy from MoorAI for AI Servers judges each tool call the model returns; the inference server, Ollama, llama.cpp, LM Studio or vLLM, is bound to loopback. A self-hosted Management Server holds the signed policy, the Industrial / OT preset and content-free alerts, runs with no internet access, and devices keep enforcing when it is unreachable. Below, the OT zone of PLCs, safety systems and the historian: MoorAI governs the agents that can reach them and never sits inside them. Evidence goes out one way as a signed pack verified with OpenSSL. Local LLMs in air-gapped OT The gap stops the cloud risk. What still crosses it is checked at each step. TRANSFER STATION moorai-model-scan pickle · PyTorch · GGUF ONNX · Keras · TensorFlow SafeTensors read, never loaded · sha256 then across on removable media LOCAL-LLM ENCLAVE · NO CLOUD WORKSTATIONS MoorAI for Agents each command, file read and tool call, before it runs MODEL PROXY MoorAI for AI Servers each tool call the model returns, judged first INFERENCE SERVER Ollama · llama.cpp LM Studio · vLLM bound to loopback MANAGEMENT SERVER, SELF-HOSTED signed policy · Industrial / OT preset · content-free alerts runs with no internet access; devices keep enforcing when it is unreachable OT ZONE · PLCs · SAFETY SYSTEMS · HISTORIAN MoorAI governs the agents that can reach them. It never sits inside them. EVIDENCE OUT, ONE WAY signed pack, verified with OpenSSL Model files, maintenance laptops and agent tools still cross the gap. AI security at the point. · Open source · MIT · moorai.dev MoorAI

Sites that cannot send process data, drawings or maintenance records to a cloud AI service are running models on their own hardware instead: Ollama, llama.cpp, LM Studio or vLLM on a server inside an isolated network, with agents that call it. Isolation removes the cloud risk. It does not remove the agent risk. An agent with shell, file or MCP access can do on an isolated network what it can do anywhere else, and on an operational technology (OT) network it may be one hop from an engineering workstation.

Why isolated sites are moving to local models

For many OT networks a cloud model is not an option: the data may not leave, or the network has no route out by design. Open-weight models change that trade-off. A capable model runs on one server, and the local runtimes serve an OpenAI-compatible API, so an agent written for a cloud provider can call a model inside the plant by changing its base URL.

Government guidance points the same way. The joint Principles for the Secure Integration of Artificial Intelligence in Operational Technology, led by CISA and Australia’s ACSC in December 2025, tells operators to ask whether vendors can run on premises without continuous internet access, to avoid sharing sensitive data with models that external parties host, and to move data out of OT through one-way transfer rather than persistent inbound access.

What still crosses the gap

An air gap removes network routes. People, files and devices still cross it, and the best-documented attacks on isolated networks used exactly those paths.

Model files and tools on removable media

Stuxnet spread on removable drives and went after Siemens STEP 7 and WinCC engineering software. ProjectSauron (2016) used hidden areas on USB drives to move data out of air-gapped networks, and GoldenJackal (2024) used USB drives to carry tools in and data out. A model file is the newest thing on that drive, and not an inert one: a pickle-based checkpoint can run code when it is loaded, and a GGUF file carries a chat template written in Jinja.

Maintenance laptops

A vendor or integrator laptop that joins for a day brings its own agents, its own MCP servers and its own configuration.

Agents near engineering workstations

An agent with a shell can run a protocol client. An agent given an MCP server or a function tool for the historian or a controller can write through it.

Policy and evidence

With no cloud console, policy has to reach devices and evidence has to leave the site without a live connection.

A hardening checklist for a local-LLM enclave

1. Scan model files before they cross

Scan every model file on the transfer station before it goes on the media, and again inside. moorai-model-scan reads a file without loading or executing it and gives one verdict per file (unsafe, suspicious, clean, allowed or unscanned) with its sha256. It reads pickle and PyTorch, Keras, TensorFlow SavedModel, ONNX, GGUF (including Ollama’s extension-less blobs) and SafeTensors. It flags dangerous pickle imports and GGUF chat templates that reach Python internals, and exits 1 on an unsafe or suspicious file, so it can gate a transfer script. Known-good hashes go on an allow-list with --allow.

moorai-model-scan /media/staging --json

The scan is static: it never runs the model, so a backdoor that fires only on certain inputs is out of its reach.

2. Keep inference on loopback, or inside the enclave

Treat the enclave as its own zone, in the zones-and-conduits sense of IEC 62443-3-2, with the transfer path as a defined conduit. Bind the inference server to loopback or to the enclave’s own interface, and put the model proxy in front of it. MoorAI’s daily heartbeat reads the listening sockets, matches them to local model runtimes and classes each bind as loopback, all interfaces or LAN. A model server reachable without MoorAI raises a content-free alert. The model proxy listens on 127.0.0.1 and routes to any OpenAI-compatible local server’s /v1:

moorai-model-proxy --mode enforce --route /plant=http://127.0.0.1:8000/v1

In enforce mode each tool call the model returns is judged before the agent framework receives it, and a denied call is refused or withheld.

3. Give agents the least they need

Turn on the MCP approval gate, so only approved servers answer, and tool drift blocking, so a tool that changed after approval is refused until it is approved again. The MCP guard and gateway check each tool call’s arguments before the server sees it. Egress rules name which program may reach which host, port, method and path for the destinations a command or tool call names, with egressDefault: "block" for the rest.

For agents that can reach controllers, the Management Server’s Industrial / OT preset denies OT write, setpoint, controller-program, safety-system and historian-delete functions by name at the model proxy, with name patterns for Modbus, OPC UA, S7, DNP3, BACnet and similar tools. Method calls, historian writes and alarm handling ask first, and read-only protocol calls are reported. The preset also denies destructive commands and bulk exports, denies MCP servers off the list you enter, and fails closed. Matching is by function name, so add your own tools’ names.

MoorAI governs the AI agent on the host it runs on. It never sits inside a PLC, a safety instrumented system or the historian. Those belong to deterministic components built to the IEC 61508 and IEC 61511 functional-safety standards and the IEC 62443 security series.

4. Sign the policy, and let it work offline

The Management Server signs each tenant’s policy with ed25519, and the device verifies it against a key held outside the agent’s write scope, such as a root-owned policy.pub. Enforcement needs no network. A device whose console is unreachable keeps enforcing its cached policy, then its last-known-good verified policy, then the offline default the administrator chose (a fail-closed default, or the built-in prevention defaults). The package and MCP pre-install checks take --offline and report not checked instead of calling out.

5. Keep evidence on site, and export it one way

Alerts carry a category, a risk level and a keyed one-way hash, never the prompt, the file or the matched text. Each finding is also written to the device’s own action audit log. An alert is sent to the console once and not retried, so run the Management Server inside the enclave, where every device can reach it. It delivers them to an on-premises SIEM collector at a private address you list. For an audit it builds an evidence pack: a zip whose manifest is signed with the tenant’s policy key and checked with OpenSSL alone, with no console and no network. Carry it out of the enclave one way, and verify it on the other side.

Where each MoorAI part fits

PartWhere it runsWhat it does there
MoorAI for Agents
free, open source (MIT)		Windows and macOS workstations where agents run, and the transfer stationChecks each command, file read and tool call before it runs. Lists the local model runtimes and flags exposed ones. Ships moorai-model-scan.
MoorAI for AI Servers
priced per server		In front of the inference server and the tool serversThe model proxy, the MCP gateway, the Agent SDK and scan-before-embed for the documents a local retrieval pipeline indexes.
MoorAI Management Server
free to self-host, no user limit		Self-hosted inside the enclaveSigns policy, holds the Industrial / OT preset, receives content-free alerts and builds evidence packs. It runs with no internet access.

Self-hosting is the natural fit for an air-gapped site: the console that holds the fleet’s records stays inside the boundary. The hosted console at app.moorai.dev is a free trial, then contact us, for sites that can reach it.

Sources

See also: Treat AI as critical infrastructure, MoorAI for AI Servers and MCP security.

Keep agents inside your enclave’s rules.
Self-host the Management Server free, with no user limit, and enroll your workstations. MoorAI for Agents is free and open source under MIT.
Request a private deployment → Download free