Separate documented OT compromises from evidence of AI involvement. Poland’s energy incidents and Iran-linked PLC attacks illustrate operational exposure; Dragos’s water-utility investigation specifically examines AI-assisted activity. These sources do not establish that every incident used AI.
TL;DR
- Documented reality: wiper malware and destroyed RTUs in Poland's energy sector, Iranian APTs against US water and energy utilities, an AI-assisted ICS attack on a water utility analyzed by Dragos.
- Evidence limit: Dragos reported no observed fully autonomous agentic attacks in its ICS/OT investigations at the time of its analysis.
- AI's real role today: accelerant, not autonomous perpetrator, recon, exploit development and malware generation at machine speed.
- Regulatory assessment: check entity scope, significant-incident criteria and the applicable AI Act classification and timetable.
The reality: these incidents are documented
Poland's energy sector: wiper malware and destroyed RTUs
In December 2025, attackers compromised OT and ICS systems in Poland's energy sector, hitting renewable energy installations, a combined heat and power plant and an industrial company. Entry came through vulnerable, internet-exposed edge devices; wiper malware was then deployed and remote terminal units (RTUs) were physically damaged. CISA documented the incident in February 2026 as a case study in OT security gaps.
Iranian APTs against water and energy utilities
In April 2026, CISA and the FBI jointly warned about Iran-affiliated APT groups attacking internet-exposed programmable logic controllers (PLCs) across US critical infrastructure sectors, including water/wastewater systems, energy and government. Some victims suffered operational disruption and financial damage. Not a science-fiction scenario, documented present.
The water utility: AI as attack copilot
Dragos’s water-utility investigation examines AI-assisted activity and the attacker’s artefacts. The practical lesson is to inspect the actual tooling and access path before attributing an operational incident to an autonomous agent.
The hype check: what Dragos actually says
In its water-utility analysis, Dragos distinguishes AI-assisted attacker workflows from fully autonomous OT attacks. Its reported observations are a bounded finding, not proof that autonomous attacks are impossible or have never occurred anywhere.
The real 2026 threat looks different:
- AI as accelerant, not autonomous perpetrator: attackers use AI for reconnaissance, vulnerability analysis, exploit development and malware generation, a human still makes the decisions. For now.
- Classic weaknesses remain the entry point: internet-exposed PLCs, unpatched edge devices, missing network segmentation. The Poland and Iran cases didn't need superintelligence, they needed open doors.
- The BSI confirms the trend: in its current advisory on AI's impact on cybersecurity, Germany's federal cybersecurity agency describes modern AI systems as increasingly able to identify vulnerabilities autonomously and convert them into usable attack paths, the gap between "assisted" and "autonomous" is closing.
Anyone announcing "autonomous AI attacks on the power grid" today is exaggerating. Anyone ruling them out for the coming years is naive.
The flip side: AI agents as defenders, and as new risk
The same technology is available to defenders. AI agents already handle alert triage in SOCs, anomaly detection in OT networks and automated incident response, often the only way to scale given the chronic skills shortage in critical infrastructure.
But: every defensive AI agent is itself a critical component. An agent with access to control systems is a high-privilege attack target (see: confused deputy) and a potential source of failure. If you deploy AI agents in critical infrastructure, treat them like any other critical component:
- Hard permission boundaries, least privilege, no blanket admin rights on OT systems
- Complete monitoring, every agent action must be logged and auditable
- Mandatory kill switch, an agent that can't be stopped instantly has no place near control systems
- Realistic threat modeling, the agent belongs in the risk register, not just the innovation deck
For more on the identities and permissions behind AI agents, read our guide Non-human identity security: risks and controls.
Regulation 2026: NIS2, KRITIS umbrella act and the EU AI Act
For European, and especially German, operators, the regulatory frame tightens threefold:
- NIS2 / German BSIG: covered entities must assess risk-management and reporting duties. The 24-hour early warning concerns significant incidents; see our reporting guide.
- KRITIS umbrella act: for the first time, binding requirements for the physical resilience of critical facilities, cyber and physical protection converge.
- EU AI Act: some safety-component uses in specified critical-infrastructure contexts can be high-risk. Assess the specific use case and the current application timetable; being deployed in critical infrastructure alone is insufficient.
The regulators' message is consistent: AI in critical infrastructure is allowed, but only governed, documented and stoppable.
What operators should prioritize in 2026
- Reduce the attack surface. No internet-exposed PLCs and edge devices, nearly every documented incident started exactly there.
- Re-check OT/IT segmentation. Wiper malware like Poland's is only devastating where networks are flat.
- Add AI threat scenarios to risk management. AI-accelerated attacks shrink your response window, detection and response must scale with them.
- Govern your own AI agents. Inventory them, scope permissions, implement kill switches, before NIS2 auditors or attackers look first.
- Use regulation as a roadmap. Start the NIS2 gap analysis and AI Act classification now, not at the deadline.
Conclusion: between panic and naivety lies preparation
The cited sources document OT compromises and, in the Dragos investigation, evidence of AI assistance. They do not establish autonomous attacks across all three campaigns. Operators can act on the demonstrated weaknesses now: exposed interfaces, excessive access and inadequate recovery controls.
On Elmoz
#FAQ
Have AI agents attacked critical infrastructure autonomously?
Dragos reported no observed fully autonomous agentic attacks in its ICS and OT investigations at the time of its analysis. The documented role of AI so far is an accelerant for reconnaissance, exploit development and malware generation.
Which critical infrastructure incidents are documented for 2025 and 2026?
Wiper malware and physically damaged RTUs in Poland's energy sector in December 2025, documented by CISA in February 2026, and Iran-affiliated APT attacks on internet-exposed PLCs in US water, energy and government systems, the subject of a joint CISA and FBI warning in April 2026.
How should an incident be attributed to AI?
Inspect the actual tooling and the access path before attributing an operational incident to an autonomous agent. An AI-assisted workflow and a fully autonomous attack are different findings.
Next step: check this week which of your OT components are reachable from the internet. It's the question every one of these attacks started with. Elmoz maps what your agents and machine identities can actually reach.