Why AI is making our power grid more vulnerable

The risk to our energy infrastructure—the systems that keep our lights on and hospitals running—is rising. Much of this equipment was built decades ago and was never intended to connect to the internet. Because of this, these systems are often fragile. Fixing them is difficult because some of the original manufacturers no longer exist to provide security updates. When updates are available, they are often slow to implement because physical machinery, known as operational technology, cannot be rebooted or patched as easily as a home computer. AI is now acting as a force multiplier, allowing less-skilled hackers to launch sophisticated attacks by using large language models—the technology behind tools like ChatGPT—to read complex technical manuals and identify weak spots that they would not have been able to find on their own.

To understand why this is such a major issue, think of the energy grid not as a modern software platform, but as a giant, aging factory floor. This machinery relies on specialized code to control physical processes, like turning a turbine or opening a valve. A standard cyberattack usually requires a hacker to spend months researching specific, obscure technical protocols to understand how this machinery talks to itself. Today, a hacker can feed those same dense technical manuals into an AI. The AI acts like an expert intern that has memorized every instruction manual in existence, instantly spotting ways to connect different vulnerabilities to bypass security. Defenders are at a disadvantage because they must protect every single door in a massive, outdated building, while an attacker only needs to find one window left unlocked to cause a disruption.

The arrival of AI means that digital attacks are happening faster than ever, and our current grid is struggling to keep pace. The solution is not necessarily better AI, but more cautious physical management. Some experts suggest that if we cannot guarantee the security of a piece of equipment, the safest move is to simply disconnect it from the internet entirely. While tech companies are now pledging funds to use AI for defense, there is a legitimate concern that adding more complex AI software into delicate, decades-old systems might cause as many problems as it solves. The ultimate lesson here is that our digital defenses are only as strong as the oldest, most neglected piece of equipment in the chain.