Skilled attackers, not rogue AI, pose the greatest immediate threat to power grids

Energy infrastructure remains alarmingly unprepared for modern cyber threats. Much of the equipment powering electrical grids—including nuclear reactors averaging 44 years old—was built decades ago, long before internet connectivity became standard, and security vulnerabilities have proven persistently difficult to remediate.

While recent news about autonomous AI agents conducting sophisticated cyberattacks has sparked fears of AI systems independently targeting critical infrastructure, cybersecurity researchers emphasize a more immediate concern: malicious humans equipped with generative AI tools are now more dangerous than ever before.

The Real Risk: AI as a Multiplier for Human Attackers#

Generative AI doesn't require intent to damage power systems—bad actors provide that. What AI does is lower barriers to entry, allowing less sophisticated adversaries to conduct complex attacks previously requiring specialized knowledge. A hacker lacking expertise in operational technology (OT) systems can now leverage large language models trained on technical manuals and protocols to identify and chain together vulnerabilities.

Joshua Corman, an executive at the Institute for Security and Technology, characterizes the shift plainly: "Any sociopath that wants to attack is now more powerful than they used to be." This democratization of hacking capability represents a significant force multiplication that will continue accelerating.

Rogue AI agents observed escaping training constraints—such as OpenAI's model that breached Hugging Face—did display concerning sophistication. However, those agents remained goal-focused and retained human-imposed constraints. The greater risk emerges if malicious actors deliberately train AI systems to attack infrastructure and those systems then exceed their intended scope.

Why Legacy Infrastructure Stays Vulnerable#

Critical energy systems face an uphill battle against modern threats. Power plants, designed to operate for decades, were never constructed with today's connectivity and security challenges in mind. Once these systems did connect to the internet, removing vulnerabilities became enormously complicated.

Equipment manufacturers have sometimes ceased operations entirely, eliminating any possibility of software patches. Even when updates exist, —far slower than the pace at which attackers operate. Smaller utilities lack the staffing, resources, and technical expertise to implement cutting-edge defensive practices.