Humans, not rogue AI, are still the biggest cybersecurity risk to energy systems

“The true difference from AI is that it’s letting adversaries move more quickly — but it’s very challenging for those defending the infrastructure to match that pace,” says Sophie McDowall, a research associate at the Foundation for Defense of Democracies’ Center on Cyber and Technology Innovation.

Intent is a key factor when assessing the risks posed by generative AI. When an OpenAI model managed to break out of the company’s training parameters to attack AI lab Hugging Face , “Some of the sophistication and the capabilities and just what we saw in that were really eye-opening and in a sense terrifying in terms of how effective they were,” says Rob Denaburg, cybersecurity program senior manager at the American Public Power Association, which represents community-owned utilities across 2,000 municipalities.

But Denaburg points out that even in the Hugging Face hack and similar instances of AI agents breaking into systems they were never supposed to target, the rogue agents remained focused on fulfilling their training goals. If someone was to train a model to carry out an attack on energy infrastructure and agents broke out of the sandbox in that scenario, it would probably be a bigger concern for a utility. Again, that involves human adversaries with malicious intent.

Historically, adversarial nation-states were largely considered the biggest cybersecurity threat to critical infrastructure. “They’re going to be more disciplined,” Corman says, and more capable of undertaking a sophisticated cyberattack. Now, AI is making it easier for less-skilled adversaries to launch an effective assault.

“A bad-actor human can use these tools to be better than they naturally would be to attack things they normally didn’t know how to … because whereas they may not know OT protocols and OT networks and OT strategies, the LLM has read the manuals and does know what to do,” Corman says.

Utilities have to be more prepared, and defensive strategies are similar regardless of who the bad guy is. “AI or not, it is at the end of the day, still a cyberattack,” Denaburg says. “Even though AI can help an adversary maybe chain vulnerabilities together and automate some of the process going from initial access to exploit … as long as you can stop them in one spot, they can’t carry out that attack.”

Power companies can follow a range of best practices to safeguard critical infrastructure . Some of them are non-cyber solutions, like ensuring systems can switch to manual operations when needed or in some cases pulling back on how interconnected this infrastructure is in the first place. Increasingly, “in the face of the AI stuff, they’re starting to realize if we can’t protect it, disconnect it,” Corman says.

“They’re offering support for a problem that they are partially causing.”

Governments and the companies developing advanced AI models hold responsibility, too, McDowall says. It was a positive step, she notes, that OpenAI CEO Sam Altman recently met with utilities to discuss securing power grids. But there’s a lot more they could do to prevent disaster, she says. “They’re offering support for a problem that they are partially causing,” while failing to adequately control their own technology advancements, McDowall tells The Verge .

And while there are regulatory guardrails for research and development when it comes to nuclear technologies and hazardous materials, there aren’t yet the same policy safeguards for AI. “This is a technological scientific development that could cause potential risk to critical infrastructure systems, that can cause potential threat to human life. And so there does need to be restrictions,” McDowall says.“I recognize that we also don’t want to limit development, but there’s no reason that we can’t drive research forward while also doing it responsibly.”

She points out that there’s a dearth of research into how AI might be used to improve cybersecurity for energy systems — particularly beyond just red teaming to discover vulnerabilities.

Earlier this month, OpenAI pledged $1 billion toward subsidizing training and access to new models that are supposed to help defend critical infrastructure.

“In the coming months, AI-enabled cyber attacks will become far more widespread and sophisticated as models around the world become increasingly capable,” OpenAI said in the September 3 announcement. “Frontier AI can help defenders move faster.”

But Corman cautions against relying on friendly AI agents to fight off the malicious ones. They could both be hard to control in the sensitive confines of an OT system for critical infrastructure.

“It’s also really dangerous to introduce too much change too fast in an OT environment,” Corman says. “Now we have an AI bull fighting another AI bull in an OT china shop.”