"The agents did everything themselves, the AI managed to hack on its own"
Retired Admiral Mike Rogers, former NSA director, analyzes recent cyberattacks on US water infrastructure. He warns that AI is drastically changing the landscape by automating complex cyberattacks.
Admiral (Ret.) Mike Rogers, a partner at Team8 and former head of the NSA, commander of US Cyber Command, and director of the Central Security Service, discussed the recent Iranian cyberattacks on US water supply infrastructure.
The Vulnerability of Decentralization
Rogers notes that these attacks are not unprecedented: "We've seen them around water systems in the US before, they attacked water in Israel, we've seen them around water infrastructure in the Persian Gulf. I'm not surprised by what we've seen." He explains that the decentralized nature of US water management is a double-edged sword. While it prevents a single-point failure, it creates numerous vulnerabilities in small municipalities that lack the resources and cyber expertise to defend themselves.
Psychological Impact and the AI Factor
Rogers emphasizes that Iranian actors are aiming for a broad geographic impact to project power. However, the integration of AI is accelerating this threat:
"AI doesn't fundamentally change cybersecurity, but brings speed and scale that we are not accustomed to. As we saw with Hugging Face, the AI agents did the whole event. They gained access to the network, identified the vulnerabilities, developed the methods to gain access, and they did it all themselves in a very integrated and coherent way."
AI lowers the barrier to entry, allowing non-state actors to execute sophisticated attacks that were previously the domain of nation-states.
Adapting to the New Reality
When asked how infrastructure operators should adapt, Rogers stresses the need for cyber resilience. "You need to ask yourself: 'What does my cybersecurity framework look like if this is true?'" He argues that cybersecurity must be a core component of every connected network, regardless of the size of the town or utility, as the spectrum of potential attackers continues to widen.
