Human Error, Not Rogue AI, Still Drives Energy Grid Cyber Risk

Human error and organizational weakness, not autonomous artificial intelligence, remain the primary cybersecurity threat to energy infrastructure, according to reporting from The Verge that draws on interviews with cybersecurity researchers, including Joshua Corman, executive in residence for public safety and resilience at the Institute for Security and Technology (IST).

Is AI already attacking the power grid on its own?

Recent incidents of AI agents orchestrating complex cyberattacks have raised questions about whether the technology could act independently against critical systems, according to The Verge. The report notes that some AI developers have floated the possibility of a roughly 10 percent chance that artificial intelligence could one day pose an existential threat to humanity — a figure cited in the piece as context for public anxiety about the technology's trajectory, not as a specific estimate tied to grid attacks.

Why do researchers still point to people as the main risk?

Corman told The Verge that the vulnerability of energy systems predates the current wave of AI concern. "We were always prey. We were just kind of surviving at the appetite of our predators," he said, describing a security posture that has long relied on attackers not fully exploiting existing weaknesses rather than on systems being robust. The Verge reported that a Department of Homeland Security warning about Iranian actors and sympathizers targeting U.S. infrastructure had already highlighted this gap before the current debate over AI-driven attacks emerged.

How does AI change the threat even without acting alone?

The central finding attributed to Corman and other cybersecurity researchers is not that AI removes the human element from attacks, but that it amplifies what already-capable attackers can do. "Any sociopath that wants to [attack] is now more powerful than they used to be," Corman told The Verge, describing AI as a force multiplier for existing malicious actors rather than a wholly new category of autonomous threat. That framing shifts the policy question from stopping rogue machines to hardening the human and institutional systems that AI tools can now help attackers exploit faster or at greater scale.

What should energy operators and policymakers watch for?

The Verge's reporting does not specify a set of technical fixes or regulatory proposals in the excerpted material, focusing instead on the shift in threat framing: from AI as an independent actor to AI as a tool that increases the reach of attackers who already understood the weaknesses in energy infrastructure. The piece situates this discussion within the broader debate among AI developers themselves over the technology's long-term risks, including the existential concerns referenced by the 10 percent figure.

By the numbers

• 10 percent — the chance some AI developers have cited for AI eventually posing an existential threat, a figure The Verge presents as context for the broader anxiety driving cybersecurity conversations.
• More than a decade — the reporting experience Verge senior science reporter Justine Calma brings to energy and environment coverage, underscoring that concerns about grid vulnerability predate the current AI debate.

Glossary

• Rogue AI agent: An AI system capable of independently planning and executing complex tasks, including cyberattacks, without step-by-step human direction.
• Critical infrastructure: Systems such as power grids, water treatment, and energy networks whose disruption could cause significant public harm.
• Force multiplier: A tool or capability that increases the effectiveness of an existing actor's efforts without replacing that actor.

Full reporting: The Verge.