What The Tech: Experts explain how AI can disrupt electricity, drinking water and other services
BY JAMEY TUCKER, Consumer Tech Reporter
Artificial intelligence could make it easier for hackers to disrupt electricity, drinking water
and other services communities depend on every day.
Imagine waking up one morning to discover there’s no electricity, no running water, and traffic
lights aren’t working.
A powerful storm could cause that kind of disruption. But cybersecurity experts warn that
hackers using artificial intelligence could potentially cause widespread outages and damage to
critical infrastructure.
And the most troubling part may be that AI could make sophisticated cyberattacks possible for
people with far less technical experience.
It’s one of the threats being examined in the What the Tech? series, “AI: What Could Go Wrong?”
AI could make hacking easier
Alon Nachmany runs a cybersecurity company that protects the computer systems operating
water treatment facilities, power stations and other critical infrastructure.
Many of those systems were developed decades ago, long before cybersecurity became a
major concern.
“All of this is built for reliability, not security,” Nachmany explained.
These systems control equipment that communities rely on every day. Computers operate
pumps, electrical substations, water treatment equipment and other machinery. Some of those
systems can be accessed remotely, creating potential vulnerabilities if they aren’t properly
secured.
Traditionally, exploiting those weaknesses could require considerable technical knowledge.
Artificial intelligence may lower that barrier.
“What AI enables threat actors, or could even be teenage kids just hanging out, is the ability to
just do more,” Nachmany said.
He demonstrated a simulated control system showing how AI could help someone create
software for interacting with industrial equipment.
“AI can actually help build the tools that you would need in order to hack these environments,”
he explained.
He showed how an AI-assisted interface could include commands such as shutting down an
electrical substation or increasing the chlorine flowing into a water system.
The demonstration was a simulation, not an attack on an operating utility. Successfully
accessing real infrastructure would still require overcoming security protections.
Water systems and power plants are already targets
The danger isn’t entirely hypothetical.
Hackers have targeted water and wastewater systems across the United States. Federal cybersecurity officials have warned about the vulnerabilities of internet-connected industrial equipment, including older systems that may lack modern security protections.
These attacks are not necessarily carried out using artificial intelligence. However, cybersecurity
experts worry that AI could help attackers find vulnerabilities, write software and automate parts
of an attack.
Chris Canal, an artificial intelligence expert, says one of the most concerning developments is
AI’s growing ability to identify weaknesses in computer programs.
“I think one of the most critical advances is the ability to find new vulnerabilities in existing
software,” Canal said.
He warned that increasingly capable AI models could potentially perform some of the same
work as highly skilled hackers.
The consequences could go far beyond stolen passwords or personal information.
A successful attack on critical infrastructure could interrupt electricity, disrupt water service,
interfere with industrial equipment or force operators to shut down systems as a precaution.
In 2021, a ransomware attack on Colonial Pipeline prompted the company to temporarily shut
down its pipeline operations, disrupting fuel supplies across the eastern United States.
Federal agencies warn of growing risks
Federal cybersecurity agencies have warned that malicious actors are targeting the industrial
control systems used by utilities and other essential services.
Artificial intelligence introduces another concern: Attackers may be able to use increasingly
powerful software to develop and adapt their techniques more quickly.
AI can also be used defensively, helping cybersecurity teams identify unusual activity and detect
possible intrusions.
But Nachmany worries that some critical infrastructure operators are still struggling to secure
equipment that was never designed to withstand modern cyberattacks.
“I think there’s definitely some scary things that are going to end up happening,” he said. “Part
of that learning curve is going to be outages in different places and different things.”
Another warning: AI that copies itself
The concerns about losing control of artificial intelligence extend beyond hackers targeting
infrastructure.
Researchers at Anthropic, the company behind the Claude AI assistant, have warned about the
possibility of future AI systems becoming capable of copying themselves across internet-connected computers and devices.
In a research report, the company explored how smaller AI systems might eventually spread
across networks without depending on one central data center.
That could make a self-replicating AI system particularly difficult to stop because there might be
no single location where it could simply be switched off.
The scenario remains a potential future risk, not evidence that AI is already spreading
uncontrollably through household appliances.
What does this mean for the average person?
Most people have no direct control over the cybersecurity systems protecting their town’s water
supply or electrical grid. Those responsibilities belong to utility operators, equipment
manufacturers and government agencies.
But the warnings underscore how dependent modern communities have become on connected
computers.
The same technology that makes it possible to monitor and manage critical infrastructure
remotely can also create opportunities for attackers if security measures fail.
The frightening possibility isn’t simply that artificial intelligence could be used to disrupt a town.
It’s that AI could give people who previously lacked the technical expertise new tools to attempt
those attacks.
And that’s why cybersecurity experts say protecting critical infrastructure is becoming
increasingly urgent.
