Humans, not rogue AI, are still the biggest cybersecurity risk to energy systems

Your home's power can be disrupted by less-skilled hackers leveraging AI tools.

Cybersecurity experts indicate that human actors, rather than rogue artificial intelligence, remain the most significant threat to energy systems. While the potential for AI to cause catastrophic failures is acknowledged, the immediate concern stems from generative AI tools amplifying the capabilities of malicious human users. Many energy infrastructures were built decades ago, predating modern internet security, making them inherently vulnerable. Efforts to patch these legacy systems are complicated by defunct manufacturers and the slow update cycles of operational technology (OT). Smaller utilities often lack the resources for advanced defenses. The core issue is that AI acts as a force multiplier, enabling less sophisticated individuals to launch more damaging attacks. Experts stress that defensive strategies remain fundamentally the same: stopping an attack at any point can prevent its success. Companies are increasingly considering disconnecting vulnerable systems if protection is not feasible. OpenAI has pledged $1 billion to support AI in defending critical infrastructure, though caution is advised against introducing too much rapid change into OT environments.

The increasing accessibility of powerful AI models lowers the barrier for entry for cyberattacks against critical energy infrastructure, a significant departure from the historically nation-state-driven threat landscape. This democratization of advanced attack capabilities means that even individuals with limited technical expertise can now exploit vulnerabilities in legacy systems that were never designed with robust cybersecurity in mind. The challenge for defenders is compounded by the difficulty in patching and updating these aging operational technology systems, creating a widening gap that AI-powered adversaries can exploit.

The race to develop and deploy AI for cybersecurity defense, while promising, introduces its own set of risks. The introduction of AI agents, whether for offense or defense, into sensitive operational technology environments could lead to unforeseen complications and escalations. Experts warn that the rapid pace of AI advancement outstrips current regulatory frameworks, creating a need for responsible development and deployment to prevent potential large-scale disruptions to essential services.