AI-Assisted ICS Attack on a Water Utility | Dragos
Contact Us
Menu
Contact Us
Login
Search Query
Submit Search
Show Search
DISC 2026: Nov 4–6 · Registration is now open for the 10th Annual Dragos Industrial Security Conference. Register Now →
Close
Blog
AI in the Breach: How an Adversary Leveraged AI to Target a Water Utility’s OT
May 6, 2026 10:00 AM<br>8 min read<br>Jay Deen
Table of Contents
Background: Scope of the Mexican Campaign
How AI Was Used to Conduct the Intrusion
How AI was Used to Target an OT Platform
An AI-Built Framework
What This Means for OT and ICS Defenders
Is AI lowering the barrier to OT targeting?
Dragos is sharing an early real-world observation of an adversary leveraging commercial AI tools to identify and target an operational technology (OT) environment during an intrusion.<br>In late February 2026, researchers at Gambit Security recovered a vast collection of materials related to a large-scale compromise of multiple Mexican government organizations between December 2025 and February 2026 and identified substantial evidence that an unknown adversary had leveraged Anthropic’s Claude and OpenAI’s GPT AI models to carry out core intrusion activities. Dragos assisted Gambit’s investigation, specifically focusing on an intrusion against a municipal water and drainage utility, and identified a significant compromise of the utility’s enterprise IT environment had escalated into an attempt to breach an OT environment. Evidence showed that Claude acted as the primary technical executor and independently identified the OT environment’s relevance to critical infrastructure, assessed its potential as a crown jewel asset, and investigated possible access pathways to breach the IT-OT boundary.<br>This investigation showed how commercial AI tools assisted an adversary with no prior objective in OT targeting to identify an OT environment and develop and refine a viable access pathway to OT infrastructure. These findings demonstrate how the adoption of commercial AI tools as an intrusion aid has made OT more visible to adversaries already operating within IT. As adversaries continue to integrate AI tools into their operations, the implications for defenders are twofold. First, organizations failing to implement basic security controls remain at heightened risk because AI can rapidly operationalize known offensive security techniques against exposed systems, such as exploiting weak authentication and default credentials to gain access. Second, as AI models continue to improve, prevention-only OT security strategies will become less effective. Firewalls, segmentation, password changes, and patching remain necessary, but organizations also need OT network visibility, detection, and response capabilities to identify adversarial AI activity when preventive controls fail. This reinforces the growing importance of strong foundational security aligned with the SANS Five Critical Controls for ICS Cybersecurity.<br>Dragos is sharing these findings to address growing concerns about the adversarial use of AI within the ICS/OT community. While public discussion has, in some cases, amplified fear and hype around autonomous or agentic AI enabling infrastructure compromise and disruption, Dragos’s assessments from real-world investigations indicate that this level of capability is not currently observed in adversary activity across the ICS/OT threat landscape, and that current AI models do not provide novel ICS or OT-specific capabilities, yet can make OT more visible to adversaries already operating inside IT environments.
Background: Scope of the Mexican Campaign
In April 2026, researchers at Gambit Security published detailed findings of a large-scale intrusion campaign conducted between December 2025 and February 2026, in which an unknown adversary had compromised multiple Mexican government organizations, resulting in the theft of vast amounts of sensitive government data and civilian records. Gambit contacted Dragos to assist in the analysis of an intrusion affecting a municipal water and drainage utility serving the Monterrey metropolitan area in Mexico.
How AI Was Used to Conduct the Intrusion
Dragos analyzed over 350 artifacts, predominantly AI-generated malicious scripts used as offensive tooling during the intrusions, which provided insight into how the adversary ran a synthesized AI operation leveraged by two commercial AI tools:
Anthropic’s Claude AI handled prompt-and-response interaction, intrusion planning, and the development and deployment of malicious tools.<br>OpenAI’s GPT models assigned analytical roles, processing collected data and generating structured Spanish output.<br>Together, the two models functioned as a coordinated capability across reconnaissance, lateral movement, enumeration, exploitation, and exfiltration, with Claude serving as the primary technical executor of the intrusion, generating, testing, and refining attack tools in near real time based on what worked and what...