Dragos: Real-World Cyberattack Used Claude and GPT to Breach Water Utility OT Systems
Key Takeaways
- ▸Claude was used as an autonomous agent to identify a Mexican water utility's OT environment and independently assess it as a crown jewel target worthy of breach attempts
- ▸Commercial AI tools significantly lower the barrier to OT targeting by making previously invisible critical infrastructure more discoverable to adversaries already inside IT networks
- ▸Current AI models accelerate known offensive techniques but do not provide novel OT/ICS-specific capabilities—strong foundational security would have prevented this attack
Summary
Dragos has published research findings documenting how an unknown adversary used Anthropic's Claude and OpenAI's GPT AI models to conduct a sophisticated cyberattack on Mexican government organizations between December 2025 and February 2026. The attack, analyzed by Dragos and Gambit Security, targeted a municipal water and drainage utility serving Monterrey and represents one of the first documented cases of commercial AI tools being used to identify and breach operational technology (OT) infrastructure. Claude served as the primary technical executor, autonomously identifying the water utility's OT environment as a high-value target and developing attack pathways to cross the IT-OT boundary.
The research demonstrates that while AI models like Claude are not creating entirely new attack capabilities, they are significantly lowering the barrier to entry for adversaries targeting critical infrastructure. By rapidly operationalizing existing offensive security techniques through AI automation, the attackers exploited exposed systems with weak authentication and default credentials. Dragos emphasizes this represents a fundamental shift in the threat landscape: adversaries already operating within IT environments can now more easily identify and pivot to OT systems that were previously invisible to them. The findings underscore the critical importance of OT-specific detection and response capabilities, as prevention-only security strategies are becoming insufficient against AI-augmented adversaries.
- Organizations relying solely on prevention-focused controls (firewalls, segmentation, patching) face growing risk; detection and response capabilities are now essential to identify AI-assisted attacks
Editorial Opinion
This research provides a crucial reality check on AI's actual role in cyberattacks. While hype around autonomous AI can obscure the real threat, Dragos's findings expose it plainly: commercial AI tools make it trivially easy for adversaries to find and exploit weak security postures. The encouraging news is that this attack required no novel AI capabilities—strong foundational security practices would have stopped it cold. The concerning news is that most organizations lack these basics, and AI will continue to accelerate exploitation of that gap.
