Commercial AI is not yet inventing novel ways to disrupt industrial processes. It is helping non-specialist attackers interpret unfamiliar environments and operationalise known techniques far faster, shrinking the time defenders have to act.
For decades, the complexity of Operational Technology (OT) environments acted as an unintended barrier to entry. Attacking a utility or factory required specialist knowledge of control-system behaviour and how digital interference might carry into a physical process. That expertise was scarce, which kept the population of attackers capable of operating in OT comparatively small.
Complexity was never a security control – it did, however, decide who could turn up and AI is eroding that. It can translate unfamiliar documentation and turn reconnaissance into usable attack paths. It does not turn a generalist into an OT engineer, but it can bring one to the edge of an operational environment faster.
What Monterrey showed
This is not a forecast. Between late December 2025 and mid-February 2026, a single operator used Anthropic’s Claude Code and OpenAI’s GPT-4.1 as core operational tools in a campaign that compromised nine Mexican government organisations. Gambit Security recovered the forensic material and asked Dragos to examine Servicios de Agua y Drenaje de Monterrey, the municipal water and drainage utility serving the metropolitan area.
We analysed more than 350 recovered artefacts, predominantly AI-generated malicious scripts. Claude Code handled much of the planning and technical execution while GPT-4.1 processed collected data into structured intelligence. Neither model invented new industrial attack capability. They let one operator absorb an unfamiliar environment and apply ordinary techniques at unusual speed.
After the utility’s enterprise IT environment was compromised, Claude Code mapped the internal network. It identified a server hosting a vNode industrial gateway and a SCADA/IIoT platform. The model recognised the gateway’s significance and analysed its single-password authentication interface. It researched vendor documentation, then generated default and victim-specific credential candidates for an automated password spray. The attempt failed, and we observed no evidence that the adversary breached the OT environment.
The dangerous mistake is to read the case as either nothing or everything. To dismiss it as ordinary automation ignores the way AI supplied missing context while, on the other hand, to call it an autonomous attack assigns the models capabilities they did not show. Both readings miss the point. AI shortened the path from an IT foothold to a credible attempt against OT-adjacent infrastructure and the difficulty of understanding an OT environment was luck, not design.
AI-enabled access, not AI-enabled effect
What we observed was AI-enabled access, not AI-enabled effect. Here, access describes Stage 1 activity in the SANS ICS Cyber Kill Chain: intrusion and discovery within IT, followed by an attempt to reach OT.
The activity did not cross into Stage 2, where an adversary develops and executes a capability intended to affect the physical process. Nothing we recovered demonstrated novel OT tradecraft or the engineering knowledge required for that effect as the models operationalised public information and known techniques, while attribution remains unresolved.
The meaningful compression was in tooling development and interpretation. Work that would have taken days or weeks was completed in hours. The operator arrived without a prior OT objective or specialist knowledge.
The relevant boundary is operational consequence
AI is shortening the route to the door but it has not removed what lies beyond it. A deliberate physical effect still requires process-specific engineering knowledge. Dragos uses extended operational technology, or xOT, as the standard for defining that environment. Any system that influences a physical process or drives a high-impact operational outcome sits inside it, whatever its conventional classification. The label matters less than the consequence. Power grids, water systems, manufacturing plants, pipelines and data centres all depend on specialised technologies and on engineering decisions taken long before any of this was in prospect.
The consequences are easy to misclassify. Our 2026 OT Cybersecurity Year in Review tracked 119 ransomware groups targeting OT organisations during 2025, up 49% on the 80 tracked in 2024. Around 3,300 organisations were affected, with manufacturing accounting for more than two-thirds of victims. When attackers encrypt a Windows engineering workstation or a human-machine interface, the incident is usually logged as an IT problem. It rarely is one, and this misclassification is why the reported operational impact of ransomware sits below the real one. Recovery is not a reimage either as teams must verify the configuration and safety functions before returning the process to a known state.
The 2025 OT Security Financial Risk Report, produced for Dragos by the Marsh McLennan Cyber Risk Intelligence Center, puts figures on the exposure. In a typical year, OT-related incidents represent around $31.1bn of modelled global financial risk. In a severe but plausible one-in-250-year scenario that rises to $329.5bn, and more than half of it is business interruption rather than data loss.
Defenders need to win the time-to-decision race
The same technology can be worth more to defenders, but only when grounded in OT-specific context. Attackers can work from public documentation and network data but defenders hold the ground truth about what each asset does and which dependencies carry operational consequence. They know the process limits and safety constraints.
This is the problem we designed the Dragos Intelligence Fabric and Dragos EmberAI to address. The Intelligence Fabric connects OT asset knowledge and frontline threat intelligence with the organisation’s own environment while Dragos EmberAI gives analysts a plain-language route into that context. Which assets are talking over a given protocol? Which vulnerabilities warrant the next patch window, judged on adversary behaviour and operational impact rather than a raw CVSS score? The analyst still makes the decision, and the evidence behind each answer stays auditable.
Organisations should start by mapping paths to consequence, not merely compiling an asset list. The map must include identity and remote-access infrastructure as well as gateways and vendor connections. Architecture must stop an IT foothold from becoming an OT problem in an afternoon. Every route across the boundary should be visible and tightly controlled, with deliberate segmentation. In the UK and Europe that work now carries regulatory weight. NIS2 and the NCSC’s Cyber Assessment Framework both expect operators to show they understand their operational dependencies and can respond to an intrusion, and neither is satisfied by an asset register.
Operational context and response roles must also be current before an intrusion begins. No model can manufacture trustworthy context from stale spreadsheets during a crisis. The same modelling puts an OT-specific incident-response plan at up to an 18.5% average reduction in financial risk, with defensible architecture and network visibility close behind. Preparedness changes the outcome.
The harder requirement is speed. The new race is between the adversary’s time-to-understanding and the defender’s time-to-decision. In Monterrey, a single operator using commercial models moved from an IT foothold to an attempt against an industrial gateway in hours. A defender working from prose reports and disconnected dashboards is not operating on that clock.
AI is compressing the time an intrusion needs to reach an operational system, and geopolitical pressure has put critical infrastructure in front of a wider set of adversaries than at any point in my career. Monterrey should be read in both directions before reaching for the alarm – and while complexity is no longer a reliable barrier, engineering fundamentals remain one.
What Stage 2 looks like
In January 2024, attackers used the malware to manipulate ENCO control systems through legitimate Modbus commands at a municipal district energy company in Lviv, Ukraine, leaving more than 600 apartment buildings without heating for almost two days in sub-zero temperatures.
FrostyGoop, as it was named, was not an AI case, and the code was never the hard part. It is a Modbus client, and our own research has shown that a model will produce something equivalent on request. What a model will not supply is the knowledge that downgrading the controller firmware removes the operator’s view, or that reporting cold water as hot stops a heating system. That is process-specific engineering knowledge, and it remains the boundary.
FrostyGoop is a reminder of what Stage 2 means and what defenders are protecting – and the consequence was not lost data, it was people in the cold.
Magpie Graham is vice-president, strategic intelligence, Dragos.
