AI can influence critical infrastructure only where people connect it to operational systems or where attackers use it to compromise those systems. The risk is real enough for controls, but “AI controls the grid” skips the permissions problem.
Start with the chain of events
Start with the chain of events, not the movie ending. A powerful model still needs a route from capability to access, persistence and real-world effect before a takeover claim becomes concrete.
Critical systems increasingly use software and automation. Keep that fact separate from the extra assumptions a takeover scenario still needs, especially access, persistence and the ability to resist intervention.
What matters in practice
Critical systems increasingly use software and automation.
The practical gap is usually between capability and authority. A system may be able to describe or plan an action without having the credentials, persistence or route into the systems needed to carry it out.
Safety-critical environments usually add segmentation, redundancy and human procedures.
Headlines often compress planning, access and successful execution into one dramatic step. Treating those as separate questions makes it much easier to see what has actually been demonstrated and what is still assumed.
Cyber attackers can use automation without needing direct AI control of infrastructure.
Recovery matters as much as capability. If people can revoke access, isolate a service or restore affected systems, the scenario is very different from one in which control cannot be regained.
Where the headline usually skips a step
Takeover claims are especially sensitive to missing links in the chain. A dramatic capability result is not enough on its own; the scenario also needs credible access, persistence and a path to consequences outside the test environment.
- Different sectors and countries have very different control architectures.
- Public reporting rarely exposes complete security details, for good reason.
What could change the answer?
The assessment should change if evidence appears that closes one of the missing operational gaps: persistent autonomous access, successful recovery evasion, or demonstrated control over consequential systems. Until then, keep those steps separate rather than assuming them.
What you can do now
Focus on the parts humans can still control: permissions, approval thresholds, monitoring and recovery. Those measures are useful whether the extreme scenario is likely, unlikely or simply too uncertain to quantify.
- Keep critical control paths segmented from general-purpose AI tooling.
- Require authenticated, logged change control.
- Maintain manual and offline recovery procedures.
A four-question reality check
When a claim sounds dramatic, work through these four questions before deciding how much weight to give it.
What can the system demonstrably do?
What tools, credentials and networks can it actually reach?
Can it keep operating after errors or intervention?
What real-world outcome follows if safeguards fail?
Bottom line
The useful question is not whether an extreme scenario can be imagined. It is which links in the chain already exist, which are speculative and which safeguards can still break the chain.
AI can influence critical infrastructure only where people connect it to operational systems or where attackers use it to compromise those systems. The risk is real enough for controls, but “AI controls the grid” skips the permissions problem.
Sources & further reading
These links are selected for the claims and methods discussed above. Primary or official sources are preferred where available.
Two useful questions
What is the biggest caveat?
Different sectors and countries have very different control architectures. Public reporting rarely exposes complete security details, for good reason.
What is the most useful next step?
Keep critical control paths segmented from general-purpose AI tooling. Require authenticated, logged change control.