Humans, not rogue AI, are still the biggest cybersecurity risk to energy systems

Cybersecurity experts interviewed by The Verge emphasize that while AI-driven attacks draw media attention, human actors continue to pose the greatest and most immediate danger to energy infrastructure. Joshua Corman of the Institute for Security and Technology described utilities as longstanding targets for attackers, noting that the threat is growing as adversaries gain access to more powerful tools. Generative AI, the experts say, acts as a force multiplier that can speed up reconnaissance, automate exploitation steps, and enable less-skilled actors to execute sophisticated attacks. A central vulnerability is the legacy nature of many systems that control electricity generation and distribution. Much critical infrastructure was designed long before networked, internet-connected environments became ubiquitous; replacing or retrofitting decades-old equipment is costly and slow. Some manufacturers of older devices no longer exist, leaving equipment without available software patches. Even when fixes exist, operational technology often has limited maintenance windows, with updates applied only quarterly or yearly, which constrains timely remediation. Analysts stress that intent remains a key factor: AI can accelerate and expand an attacker’s capabilities, but a human-directed campaign is still required to target energy systems specifically. Rob Denaburg of the American Public Power Association pointed out that prior incidents involving AI agents breaking out of controlled environments showed impressive technical capabilities, yet those agents were pursuing pre-set objectives. If a malicious actor deliberately trained models to attack power infrastructure, the consequences for utilities would be more severe because the human adversary is driving the intent. Defensive options are pragmatic and largely independent of whether an attack leverages AI. Utilities can adopt best practices such as designing fallback manual controls, reducing unnecessary interconnectivity, and strengthening detection and segmentation to stop adversaries at a single point of failure. Experts also call on AI developers and governments to take responsibility: meetings between AI company leaders and utilities are a useful step, but analysts say more systemic controls and support are needed to mitigate risks that advanced models help create.