If you've sat through a session on AI threats this year, somebody has probably told you the attacks are mostly hype. Sometimes that somebody was me.
I've said it more than once, and I meant it every time: AI attacks are dumb.
This month two researchers made the case better than I ever did. Proofpoint's Selena Larson and Bitdefender's Martin Zugec argued in Dark Reading that AI is adding volume and errors to attacks rather than sophistication. They pointed to broken AI-generated lures and malware from named threat groups, including Kimsuky and APT36.
They're right. Then I read about the $6.
Dumb was never what protected us. Expensive was.
The agent got it wrong. It got root anyway.
Claroty's Team82 ran an experiment on the Danfoss AK-SM 800A, a refrigeration controller. They gave an AI coding agent public CVE identifiers for three flaws that had already been disclosed and patched, plus the firmware Danfoss publishes on its website without registration. None of Team82's own research went in.
The agent reproduced two of the flaws on its own. On the third, the authentication bypass, it "confidently pursued an incorrect approach" until the researchers redirected it and gave it a decompiler integration. Then it reproduced the bypass, chained it with command injection, and got root on a lab device. About 28 minutes from first analysis to working exploit. About $6 of AI usage.
Team82 is careful about the limits, and I want to be too. In their words: "The researcher remained essential, but hands-on analysis was substantially reduced," and "This was not an autonomous vulnerability discovery from scratch."
I used to treat that kind of caveat as the end of the story. It's actually the story. The machine was wrong, confidently, and a human nudged it. Nudging is a lot cheaper than doing.
France's finance minister says it's also the same controller family that was taken over at about 700 French supermarkets this month. Nobody has said how those attackers got in, and Team82 doesn't link its experiment to the attack. I won't either. But Danfoss itself says most of the units hit were older models, the kind that stay in service long after anyone stops patching them. Team82's conclusion is the line I keep rereading: "the window between public disclosure and practical exploit reproduction may be shrinking."
Dumb and cheap beats clever and rare
For thirty years, OT security relied on security by obscurity.
Breaking into a plant took a human with time, skill, and patience. That human was scarce, so attackers had to choose targets, and most plants were never worth choosing. The knowledge was scarce and highly targeted. (Anyone else have a Rainbow Series book on a shelf?)
Obscurity meant hoping nobody looked. That stopped working the day looking got free.
Refusing to answer is different.
AI helps the attacker's intelligence problem. It can totally fix his budget problem.
Since late September, one operator ran autonomous agents through an open-source framework called Cairn against more than 1,200 websites and got into more than 100. NorForge's principal researcher estimates it worked out to roughly $50 per successful intrusion, and NorForge puts the success rate near 10 percent as a reasonable assumption, not a measurement. These were websites, not plants. But look at the shape of it. An attacker who fails nine times out of ten and doesn't care is not running a weaker operation. He's running a cheaper one.
Unit 42 documented another actor this month, one it says "appears to lack the skills these operations would normally require." The AI did the reconnaissance, wrote the brute-force tools, and the actor walked out with more than 5,200 records from a university database. Unit 42's summary: "This case illustrates how AI lowers the skill barrier for cybercrime."
And at the state level, Microsoft says the China-aligned group Storm-0940 used an agentic attack framework to run a password-spray campaign that peaked at 2,900 failed sign-ins per minute. None of those attempts succeeded in that window. It didn't matter. Once the actor controlled trusted cloud application identities, Microsoft says it went from initial targeting to privileged access in less than three hours in multiple instances, against downstream customers in sectors that include energy, manufacturing, and chemicals. No OT system was named, and the three-hour figure is Microsoft's alone.
That's what slop looks like at scale. Most of it fails. The failures cost almost nothing. And the attacker never has to decide whether your plant is worth his time, because his time stopped being the constraint.
Being discoverable used to be a probability. It's now a schedule. The question isn't whether an exposed asset gets found. It's on what date.
The best objection, and why it points the same way
The strongest pushback on this argument is the one the Dark Reading piece implies: dumb attacks get caught.
Sometimes they do. In Booz Allen's industrial testbed, where AI models cleared all eight attack objectives, firewalls, segmentation, and endpoint tools still slowed the models down or flagged them, and one controller refused a stop command. Separately, Tracebit found that attacking agents reached their objective in 39 of 40 baseline runs against generic web and database targets, and that nine planted decoys, led by a fake penetration-test report, cut that to 2 of 40.
I'd want both of those working for me. But notice what worked in the second one. Nobody out-thought the machine. They changed what it could see.
A dumb attacker is only ever as good as its input.
We priced our defense against a human adversary. Detection assumes someone acts on the alert faster than the attacker moves. Patching assumes you patch faster than weaponization. Neither assumption was built for something that costs $6 a try and, in Microsoft's words, can "work around the clock."
What I'll keep saying
I'll probably keep telling people AI attacks are dumb, because mostly they are.
I'll just stop saying it like it's good news. A dumb attacker who runs against everything doesn't need to be clever. It only needs something to answer.
You can't outrun a machine. You can only be absent from its input.
Frequently Asked Questions (FAQs)
1. Why are AI-powered cyberattacks dangerous even when they are unsophisticated?
AI-powered cyberattacks are dangerous because automation dramatically reduces the cost, time, and expertise needed to launch attacks. Even when individual attempts fail, attackers can target thousands of systems repeatedly at minimal expense. For operational technology (OT) environments, this means previously overlooked industrial systems may face more frequent automated reconnaissance and exploitation attempts.
2. Can AI autonomously exploit vulnerabilities in industrial control systems?
AI coding agents can substantially automate the reproduction and exploitation of known industrial control system (ICS) vulnerabilities, although human assistance may still be necessary. In a Claroty Team82 experiment involving a Danfoss AK-SM 800A refrigeration controller, an AI agent reproduced vulnerabilities and, with researcher guidance, achieved root access on a lab device in approximately 28 minutes at an AI usage cost of about $6. The experiment did not demonstrate fully autonomous vulnerability discovery.
3. How does AI reduce the cost of cyberattacks?
AI reduces cyberattack costs by automating reconnaissance, exploit development, credential attacks, and repetitive technical tasks. Activities that previously required skilled researchers working for hours or days can sometimes be completed much faster using AI agents. This allows attackers to attempt more intrusions without proportionally increasing their staffing or budgets.
4. What makes AI-powered cyberattacks especially concerning for OT environments?
OT environments frequently contain legacy equipment, long patching cycles, and industrial control systems that must remain operational. AI-assisted attackers can exploit publicly disclosed vulnerabilities more quickly, potentially narrowing the time available for defenders to patch vulnerable devices. Internet-exposed controllers and other discoverable OT assets are particularly concerning because automated tools can identify potential targets at scale.
5. What is the difference between security by obscurity and network cloaking?
Security by obscurity relies on attackers not knowing where vulnerable systems are located or how they operate. Network cloaking instead uses technical access controls to prevent unauthorized systems from discovering or connecting to protected network resources. Unlike simply hiding information, properly implemented network cloaking restricts visibility and connectivity, reducing opportunities for automated reconnaissance and exploitation.
6. Can traditional cybersecurity defenses stop AI-powered attacks?
Traditional defenses can detect, delay, or block AI-powered attacks, but their effectiveness depends on implementation and the attack scenario. In Booz Allen's industrial testbed, firewalls, segmentation, and endpoint security tools slowed or flagged AI attack activity. However, inexpensive automated attacks can be repeated at scale, making prevention of unauthorized access and reconnaissance an important complement to detection.
7. How can network cloaking help protect industrial systems from AI-powered cyberattacks?
Network cloaking reduces the discoverability of protected industrial systems by preventing unauthorized scanning and connection attempts from reaching them. When combined with Zero Trust access controls and microsegmentation, it can limit the information available to AI reconnaissance tools and restrict attackers' ability to reach vulnerable devices. This reduces exposure without relying exclusively on rapid patching or post-compromise detection.
8. Why is preventing reconnaissance important in defending against AI-driven cyberattacks?
Reconnaissance provides attackers with information about accessible systems, exposed services, and potential vulnerabilities. AI can automate this information-gathering process across large numbers of targets. Preventing unauthorized reconnaissance reduces the attacker's ability to identify and interact with vulnerable assets, making network visibility and exposure management critical components of OT cybersecurity.
How To: Protect OT Networks Against Low-Cost, AI-Powered Cyberattacks
AI-powered cyberattacks are lowering the cost of vulnerability exploitation, reconnaissance, and automated intrusion attempts. Organizations can reduce their exposure by limiting what unauthorized attackers can discover, access, and exploit.
Step 1: Identify Discoverable OT Assets
Inventory industrial control systems, programmable logic controllers (PLCs), human-machine interfaces (HMIs), refrigeration controllers, and other critical OT devices. Identify assets exposed through public IP addresses, remote access services, and connections between IT and OT environments.
Goal: Understand which systems could be discovered or targeted through automated reconnaissance.
Step 2: Prioritize Legacy and Unpatchable Industrial Systems
Identify devices running outdated firmware, systems with publicly disclosed vulnerabilities, and equipment that cannot be immediately patched without disrupting operations.
Prioritize these assets based on their exposure, criticality, and potential operational consequences.
Goal: Reduce the risk associated with the shrinking interval between vulnerability disclosure and practical exploit reproduction.
Step 3: Implement Network Cloaking
Deploy network cloaking to prevent unauthorized users and automated scanning tools from discovering or connecting to protected OT systems.
Ensure that protected resources do not respond to unauthorized probes and that legitimate communication remains available through approved access paths.
Goal: Remove vulnerable industrial assets from the unauthorized reconnaissance process rather than relying on attackers overlooking them.
Step 4: Enforce Zero Trust Access Controls
Require identity verification and explicit authorization before users or devices can access protected OT resources.
Use phishing-resistant, passwordless multifactor authentication where supported, apply least-privilege policies, and eliminate unnecessary access pathways.
Goal: Prevent unauthorized connections even when attackers obtain information about internal infrastructure or compromise credentials.
Step 5: Segment OT Networks to Restrict Lateral Movement
Implement network segmentation and microsegmentation to separate critical controllers, industrial systems, and operational zones.
Restrict communication to authorized devices and required operational workflows.
Goal: Limit an attacker's ability to move between systems if an initial compromise occurs.
Step 6: Maintain Monitoring, Patching, and Detection
Continue monitoring for suspicious behavior, applying security updates when operationally feasible, and reviewing authentication and access logs.
Use detection controls alongside network cloaking and segmentation rather than treating any single technology as a complete defense.
Goal: Maintain defense in depth against threats that bypass preventive measures.
Step 7: Validate Protection Against Automated Reconnaissance
Test whether unauthorized systems can identify or connect to protected OT assets from relevant network locations.
Verify that legitimate users retain the connectivity needed for operations and that segmentation policies prevent prohibited connections.
Goal: Confirm that security controls reduce attack exposure while preserving industrial availability.
Conclusion
Defending OT environments against AI-powered attacks requires more than detecting increasingly frequent intrusion attempts. As AI reduces the cost of reconnaissance and exploitation, organizations should minimize unnecessary network exposure, enforce Zero Trust access, and restrict unauthorized communication.
The central principle: You can't outrun a machine. You can only be absent from its input.
American Water’s cyber incident shows why water utilities need stronger OT isolation to stop IT breaches from threatening critical infrastructure operations and availability.
Explore the complete analysis of 23 OT attacks that defeated firewalls, VPNs, and air gaps.
.svg)
.svg)
