Autonomous AI agents: a "clear and present danger" to critical infrastructure

Cybersecurity experts are sounding the alarm in *The Register*: weaponized AI agents could turn digital intrusions into physical catastrophes on OT/SCADA networks. The threat is becoming real.

What

The Register relays a warning from cybersecurity experts: autonomous AI agents now pose a "clear and present threat" to critical infrastructure. The core thesis: an uncontrolled or deliberately weaponized AI agent can turn a digital intrusion into a physical catastrophe (kinetic disaster) by targeting industrial systems (OT/SCADA, i.e., Operational Technology / Supervisory Control and Data Acquisition), power grids, or water treatment facilities.

Analysis

The risk is no longer theoretical. For months, we have documented the escalation of this vector: indirect prompt injection via official MCP (Model Context Protocol) like Azure DevOps, DeepSeek agents controlled via Telegram for automated attacks, coding agents exploiting WordPress vulnerabilities blindly. The convergence of these capabilities with OT/SCADA targets marks a qualitative leap in the threat.

Critical infrastructures exhibit characteristics that make them particularly vulnerable to this vector:

• Slow patching cycles: industrial systems have constrained maintenance windows, sometimes annual
• Legacy protocols: Modbus, DNP3, BACnet—protocols not designed to withstand intelligent, adaptive attackers
• IT/OT convergence: the growing integration of SCADA supervision systems with computer networks opens new pivot points
• Availability of local LLMs: an attacker can orchestrate a sophisticated agent on consumer-grade hardware, without traceable external APIs

Signals to watch

This narrative thread is evolving rapidly. Key developments to anticipate in the coming weeks:

• Publication of an AI-agent-specific defense framework by bodies like the U.S. CISA or France’s ANSSI
• First publicly documented incident involving an autonomous AI agent and real OT infrastructure
• Evolution of the NIS2 regulation to explicitly integrate the "autonomous agent" risk

Each episode in this thread—from the agent booking a gym class by exploiting a flaw, to prompt injection on Azure DevOps—builds a library of techniques. It is no longer a question of if these techniques will reach critical infrastructures, but when.