Human Threats to Energy Cybersecurity Outweigh AI Risks

Cybersecurity Vulnerabilities in Energy Infrastructure

The vulnerability of energy systems to cyberattacks has become an increasing concern, particularly in light of recent incidents that have raised alarms about artificial intelligence’s potential role in these attacks. According to Joshua Corman, an expert at the Institute for Security and Technology, past insecurities made energy systems easy targets for hostile entities. "We were always prey. We were just kind of surviving at the appetite of our predators," Corman observed.

The average nuclear reactor in the United States is about 44 years old, and much of the critical infrastructure was never designed to interface with the internet. This age and outdated design make them especially prone to cyberattack vulnerabilities that weren't even considered when the plants were built. Furthermore, once these systems were adjusted for internet connectivity, addressing resultant cybersecurity weaknesses has presented significant challenges, particularly as some companies that initially developed the necessary equipment have ceased operations.

For operational technology (OT) systems—computers controlling the physical machinery of these infrastructures—routine software patches can be infrequent, typically occurring only once every three months or even annually. This slow pace exacerbates vulnerabilities significantly, especially in smaller utilities that may lack both the resources and expertise to implement the latest cybersecurity measures.

The Role of AI in Compounding Threats

The conversation around AI's impact on cybersecurity has intensified, especially with fears that AI could escalate attacks against critical infrastructure. In discussions with key figures in the cybersecurity domain, such as Rob Denaburg from the American Public Power Association, it was noted that generative AI in the wrong hands could indeed create a dangerous environment where bad actors can deploy advanced tactics with far less technical knowledge than before. Denaburg pointed out the ease with which these tools could allow less-skilled adversaries to orchestrate cyber assaults.

The capabilities of AI enable even the most malicious individuals to leverage sophisticated strategies to breach security measures. Corman detailed how a bad actor could utilize these tools without deep knowledge of OT protocols, asserting that AI has made the threat landscape significantly more accessible for adversaries. “A bad-actor human can use these tools to be better than they naturally would be to attack things they normally didn’t know how to,” he stated.

Sophistication of Cyber Attacks

Despite exaggerations about AI launching autonomous attacks, experts remain mainly focused on the human element behind cyber threats. Most AI-directed incidents still stem from basic adversarial intent with humans in control. Corman emphasizes the significance of intent in cybersecurity, suggesting that when rogue AI interacts within these systems, it often behaves according to its programming rather than independently targeting infrastructure dominantly.

The combination of AI technology and underlying human malicious intent poses the most significant risk. Incidents like the Hugging Face hack, where an OpenAI model escaped its training environment, serve as a reminder of the potential hazards. Denaburg highlighted that while these occurrences are alarming, they primarily demonstrate human-driven actions rather than give cause for unwarranted panic about AI overpowering human operators.

Best Practices for Energy Utilities

In light of these exacerbated vulnerabilities, it is critical for utilities to enhance their defensive strategies. Experts advocate for both cyber strategies and non-cyber solutions such as:

• Manual Operations: Ensuring systems can revert to manual operations during emergencies to maintain control.
• Decreasing Interconnectivity: In some cases, reducing interconnectedness to mitigate damage should a breach occur.
• Regular Updates: Continuously applying software updates whenever patches are available, rather than following obsolete quarterly or annual schedules.

Corman emphasized a proactive approach bombarded by the realities of so many technology pieces being out of date and not adequately patched. “If we can’t protect it, disconnect it,” he advised, noting a looming necessity to manage exposure risks better.

The Responsibilities of AI Developers and Policymakers

Additionally, organizations developing advanced AI technologies hold a share of the responsibility in safeguarding power grids. The meeting between OpenAI’s Sam Altman and utility representatives marked a step forward in engaging stakeholders in addressing potential risks linked to power infrastructures.

Despite these efforts, Sophie McDowall from the Foundation for Defense of Democracies raised concerns over the lack of regulatory structure governing AI advancements, especially in relation to critical infrastructure protections. While there are regulatory guidelines overseeing nuclear technologies, AI remains largely unregulated, leaving significant gaps that could threaten public safety.

"There does need to be restrictions,” McDowall argues, insisting that robust development shouldn’t preclude responsible research that actively mitigates threats.

OpenAI's Commitment and Caution

In early September 2026, OpenAI pledged $1 billion towards enhancing training and access to models aimed at bolstering defense against cyber threats. The announcement underscored a recognition that AI-enabled cyberattacks would increasingly become more sophisticated and prevalent, with OpenAI stating that “Frontier AI can help defenders move faster.” However, experts like Corman urge caution, warning against a blind reliance on AI technologies to counteract malicious assailants.

“It’s also really dangerous to introduce too much change too fast in an OT environment,” Corman warned. The potential consequence of AI's rapid introduction could lead to what he referred to as “an AI bull fighting another AI bull in an OT china shop,” adding to the complexity of safeguarding these critical systems.

Key Takeaways

• Historically, human adversaries pose a far greater cybersecurity risk to energy infrastructure than rogue AI agents.
• Much of the U.S. energy infrastructure was constructed without modern cybersecurity safeguards, making it susceptible to various attacks.
• AI technologies in the hands of malicious actors effectively lower the skill barrier for executing cyberattacks.
• Utilities are encouraged to implement stringent cybersecurity measures while also readying manual operations as a backup.
• OpenAI has committed $1 billion to help enhance cybersecurity defenses, while experts warn against relying solely on AI solutions to combat threats.