Humans, not rogue AI, remain biggest cyber threat to energy systems

September 20, 2026 at 05:00 PM2 min

This digest was compiled by AI from multiple sources — links to the originals are below.

Cybersecurity experts warn that human attackers using generative AI pose a greater threat to energy infrastructure than rogue AI agents. Joshua Corman of the Institute for Security and Technology says AI is a force multiplier for any sociopath. Aging power systems, some with orphaned software, remain vulnerable to cyberattacks.

Key Facts

Joshua Corman, executive in residence at the Institute for Security and Technology, says generative AI is a force multiplier for attackers targeting energy systems.
The average age of a nuclear reactor in the US is about 44 years, and many were not designed with today's cybersecurity risks in mind.
Some companies that designed equipment still used in the power sector have gone out of business, leaving orphaned devices without software patches.
Operational technology systems controlling physical machinery may only be designed to apply updates once each quarter or year.

Human Threat Multiplied by AI

Joshua Corman, executive in residence at the Institute for Security and Technology, says generative AI makes any sociopath more powerful than before. Corman describes AI as a force multiplier that continues to grow, amplifying the capabilities of human attackers. Cybersecurity experts remain more concerned about bad actors using AI than about rogue AI agents acting on their own.

Aging Infrastructure Vulnerabilities

Much of the critical energy infrastructure was never designed to connect to the internet, making it an easy target for hackers. The average age of a nuclear reactor in the US is about 44 years, and power plants typically operate for decades. Some companies that originally designed equipment still in use have gone out of business, leaving orphaned devices without anyone to develop software patches. Even when patches are available, operational technology systems may only be designed to apply updates once each quarter or year. Smaller utilities often lack the resources, staffing, and expertise to implement the latest defensive measures.