AI Accelerates Path From IT Compromise to OT Targeting
Computer Weekly, Friday, October 23rd, 2026
A Dragos analysis of the Monterrey water utility case shows AI shrinking the time from IT foothold to OT attempts, not inventing new OT attacks.
Dragos VP Magpie Graham reviews a campaign in which one operator used Claude Code and GPT-4.1 to compromise Mexican government bodies, including Monterrey's water utility.
The models mapped the network, spotted an industrial gateway and generated credentials for a password spray that failed.
Graham calls this AI-enabled access, not AI-enabled effect: physical impact still needs process-specific engineering knowledge, as the FrostyGoop heating attack showed.
He urges mapping paths to consequence, segmenting IT/OT boundaries, controlling remote access and keeping OT incident response plans current, in a piece that includes some promotion of Dragos products.