The assumption that AI’s primary threat to cybersecurity is better phishing emails missed something significant. Dragos published findings this week describing an active intrusion against a water and drainage utility in Mexico where threat actors used Claude AI as a live reconnaissance guide inside the operational technology environment. Post-breach. Already inside the network. Using an AI model to figure out which industrial assets they were looking at and where to move next. That’s a categorically different kind of threat than faster social engineering, and the OT security community should be treating it that way.

The OT Attack That Breaks a Long-Standing Assumption

Operational technology environments have never been fully secure, but they carried a quiet advantage over traditional IT targets: steep learning curves. Industrial control systems, SCADA environments, proprietary protocols, specialized engineering workstations. An attacker who pivots from enterprise IT into an OT network typically runs headlong into unfamiliar territory. Without deep domain expertise, they struggle to understand what they’re looking at, let alone prioritize what to target. That friction was never a substitute for real security hardening, but it was a genuine barrier.

The Mexico water utility incident makes clear that barrier is now substantially lower. Attackers used Claude AI to make sense of OT assets they encountered inside the network, identifying device types, understanding protocols, and orienting themselves toward high-value targets in real time. Hiring an OT specialist was unnecessary. Pre-attack research into industrial systems became optional. A conversational interface to a general-purpose model provided enough context to navigate a utility’s control network in real time, and that was enough.

This point applies beyond Claude specifically. Any capable general-purpose AI model can serve this role. The skill floor for OT-targeted attacks has dropped, and the security assumptions built on attacker unfamiliarity with industrial systems need to be revisited.

What AI Actually Contributed to This Intrusion

Precision matters here, because the threat detection implications depend on understanding what “AI-guided” means in practice. The attackers weren’t running some custom OT exploitation framework. They were using a conversational AI assistant to interpret what they were seeing and decide where to focus. Think of it as having an expert consultant available mid-intrusion, one who can read technical context, explain device roles, and suggest what’s worth targeting, all through a chat interface while the attack is underway.

Three Phases Where AI Assistance Changes the Attack

1. Asset identification: Understanding what types of devices and systems the attackers had reached based on observable network data, protocol traffic, and device naming conventions.
2. Context mapping: Translating unfamiliar OT terminology and device roles into actionable intelligence about what those assets do and what disrupting them would mean operationally.
3. Targeting guidance: Helping the attackers determine which paths forward offered the highest impact given their current access level and objectives.

The model provided orientation and context. General-purpose AI is quite good at that, and that’s enough when the attacker already has access and simply needs to understand the terrain. What changes for defenders is the behavioral profile of the intrusion. An AI-assisted attacker moving through an OT network may look methodical and deliberate rather than chaotic. They query assets patiently, avoid obvious protocol violations, and move with a clarity of purpose that mimics legitimate technician activity. That’s a threat detection problem most OT monitoring tools weren’t designed to catch.

The Entry Points Haven’t Changed. That’s the Real Problem.

Sophisticated post-breach capability still needs a way in, and the doors being opened right now are depressingly ordinary. The same week as the Dragos report, researchers caught a phishing campaign running through Google sponsored search results, targeting credentials for ManageWP, GoDaddy’s fleet management platform for WordPress installations. Paid ads, spoofed login pages, standard credential harvesting. The mechanics haven’t evolved much in a decade.

ManageWP is an attractive target precisely because of its administrative multiplier effect. A single set of stolen credentials covers every website under management, potentially hundreds of them. MSPs and web hosting teams treat these platforms as central hubs, and attackers understand exactly what that means for blast radius.

The pattern connecting these two stories runs through most serious breach chains: sophisticated post-breach capability paired with completely routine initial access. Brute-force credential attacks, phishing through trusted ad platforms, exploiting managed service entry points. AI-guided OT reconnaissance makes what’s behind the door far more dangerous; it doesn’t need to make the front door any harder to open.

Hardening OT Cybersecurity When the Attacker Has a Smart Guide

Enforce network segmentation, not just diagram it. Proper firewall boundaries between IT and OT are the most important control against AI-guided lateral movement, because that movement is limited to what the attacker can actually reach. Purdue model architecture is familiar to most OT teams, but plenty of environments have vendor access exceptions, legacy bridges, and undocumented connections that quietly undermine it. Audit those gaps and enforce them with actual firewall rules, not just policy documents.

Build OT-specific behavioral baselines for threat detection. Generic threat protection won’t catch an attacker moving slowly and methodically through an industrial network. You need baselines specific to your environment: which devices communicate with which, which protocols are expected in each zone, what normal traffic volumes look like per segment. Deviations from those baselines, even low-volume ones, need to surface as alerts. Slow and deliberate looks suspicious in a well-characterized OT environment once you know what normal looks like.

Apply phishing-resistant MFA to every management platform. The ManageWP campaign is a reminder that platforms with administrative multiplier effect are prime phishing targets. Hardware tokens or passkeys on administrative interfaces to any managed service platform should be non-negotiable. For MSPs managing multiple clients, a single credential compromise at the management layer is a simultaneous breach of everyone in the portfolio.

Monitor outbound AI service traffic from sensitive environments. An attacker using AI assistance during an active intrusion generates outbound API traffic to external AI services. That traffic is detectable. Logging and alerting on unexpected outbound connections to AI provider APIs from OT-adjacent or sensitive network segments adds a useful layer of defense in depth against exactly this attack pattern. Most environments don’t log this today.

Harden remote access entry points. VPNs, jump servers, vendor remote access portals: these are the common initial access paths into OT-adjacent environments. Tighten them to minimum necessary privilege, enforce session monitoring, and deploy automated IP blocking tools like IPBan Pro as a compensating control against brute-force access attempts. The goal is shrinking the attacker’s window before they’re inside with their AI guide already running.

Anthropic’s CEO Dario Amodei and researchers at Tenable have both made the point recently that the real challenge is whether organizations can act on what matters before attackers do. The water utility incident is a live example of that gap. Knowing AI-assisted OT attacks were coming was different from having the incident response procedures and monitoring in place to detect and contain them when they actually arrived.

Frequently Asked Questions

Did Claude AI intentionally assist an attack on a water utility?

The model had no awareness it was being used in a malicious intrusion. General-purpose AI models respond to queries without verified context about the asker’s intent or situation. Attackers querying AI about OT protocols and device types are asking questions that look identical to legitimate technical research. This is an ongoing abuse-detection challenge for AI providers, but it’s distinct from the model deliberately facilitating harm.

Is air-gapping OT networks the right response to AI-guided lateral movement?

A true air gap is highly effective in principle, but most OT environments aren’t genuinely air-gapped even when documentation suggests otherwise. Remote access requirements, vendor connectivity, and IT-OT data integration create persistent bridges that attackers exploit. Strictly enforced segmentation with proper firewall controls and continuous monitoring of cross-zone traffic addresses the same risk and is achievable for organizations where a full air gap is operationally unrealistic.

Should smaller utilities treat this as a relevant threat, or is AI-guided OT intrusion a concern only for major national infrastructure?

Smaller utilities should treat this as directly relevant. AI lowers the expertise requirement for OT-targeted intrusions, which means attackers can target smaller facilities without recruiting specialized talent. Smaller utilities typically run fewer monitoring resources and less hardened environments than major infrastructure operators, making them attractive for attackers looking to develop OT attack capability with lower detection risk. The Mexico utility in this incident was not a massive national infrastructure target.

Sources

• Claude AI Guided Hackers Toward OT Assets During Water Utility Intrusion
• Hackers Abuse Google Ads for GoDaddy ManageWP Login Phishing
• Anthropic’s CEO Warns the “Moment of Danger” Is Real