Author’s note: This post was written during a two-week long research sprint at constellation.org. My analysis represents a preliminary attempt to formulate a detailed AI-cyber threat model of attacks against the energy grid. The conclusions reached here are therefore tentative and I seek further input from experts to refine and correct my work. I offer special thanks to Luca Righetti from openphilanthropy.org and Matthew van der Merwe from governance.ai for their generosity and rigorous insight.

This post covers the following:

AI is changing the cyber threat landscape
Catastrophic cyberattacks against critical infrastructure
Building on Lloyd’s (2015) “Business Blackout” scenario
How does the power grid work?
How could a cyberattack destabilize the power grid?
How a cyberattack could cause >$100B of damage through destabilization of the power grid: direct and indirect approaches
Three major attack scenarios causing damages on the order of $100 Billion or more
Unresolved questions
How do AI offensive cyber capability increases affect this analysis?

AI is already changing the cyber threat landscape

AI developments over the last two years are heavily shaping global perceptions of national security and cyber threats. In October 2024, the US Presidential administration issued a National Security Memorandum titled Advancing the United States’ Leadership in Artificial Intelligence; Harnessing Artificial Intelligence to Fulfill National Security Objectives; and Fostering the Safety, Security, and Trustworthiness of Artificial Intelligence. The memorandum mandates the US AI Safety Institute (USAISI), National Security Agency (NSA), and other federal agencies evaluate frontier models’ ability to aid offensive cyber operations. Furthermore, the memorandum calls on Department of Defense and Intelligence Community agencies to harness powerful AI systems in furtherance of their national security missions. This undoubtedly includes using frontier AI for offensive cyber operations.

In 2024, OpenAI published two reports detailing Russian, Iranian, Chinese, and North Korean cyber threat actors' use of the company’s proprietary AI models in offensive cyber operations tasks. These actors used OpenAI’s Large Language Models (LLM) to supplement their reconnaissance, social engineering, vulnerability research, attack tool scripting, anomaly detection...

Posts

Wikitag Contributions

Comments