Energy systems were always vulnerable

Power plants and nuclear reactors were built decades ago without internet connectivity in mind. When they eventually connected to the internet, fixing security gaps became nearly impossible.

“We were always prey. We were just kind of surviving at the appetite of our predators.”

Old equipment has no patches

Some companies that designed critical infrastructure equipment went out of business, leaving no one to develop security updates. Even when patches exist, utilities can only apply them quarterly or yearly.

AI is a force multiplier for attackers

Generative AI lets less-skilled hackers launch effective attacks they couldn't pull off alone. AI models have read the manuals on operational technology that human attackers never studied.

“Any sociopath that wants to [attack] is now more powerful than they used to be.”

Defenders can't keep pace

AI lets adversaries move faster than utilities can defend. Attackers can chain vulnerabilities together and automate attacks, while defenders struggle to update systems without disrupting critical services.

Rogue AI isn't the main worry

Even when AI agents break out of their training parameters, they stay focused on their original goals. The bigger threat is humans deliberately training AI to attack energy infrastructure.

Nation-states still most capable

Historically, adversarial nations posed the biggest threat because they're disciplined and sophisticated. Now AI is democratizing cyberattacks, letting less-skilled bad actors become dangerous.

Defense strategies work regardless

Whether the attacker is human or AI, stopping them at one vulnerability stops the whole attack. Best practices include manual backup systems and disconnecting infrastructure that can't be protected.

“AI or not, it is at the end of the day, still a cyberattack.”

Tech companies share responsibility

OpenAI and other AI developers are partly causing the problem they're now trying to solve. They lack adequate controls over their technology while offering support to utilities.

“They're offering support for a problem that they are partially causing.”

No regulatory guardrails yet

Nuclear technology and hazardous materials have strict regulations. AI development lacks similar policy safeguards, even though it poses risks to critical infrastructure and human life.

OpenAI pledges billion dollars

In September 2026, OpenAI committed one billion dollars to subsidize training and access to models designed to defend critical infrastructure against AI-enabled cyberattacks.

Friendly AI could backfire

Using AI to fight AI in operational technology systems is risky. Both could be hard to control in the sensitive environment where power grids operate, creating unpredictable outcomes.

“Now we have an AI bull fighting another AI bull in an OT china shop.”

Research gap on AI defense

There's little research into how AI can improve cybersecurity for energy systems beyond finding vulnerabilities. Developing AI-powered defenses requires dedicated study and investment.