Your lights. Your water. Your hospital. Your internet. All four depend on digital systems that foreign hackers are now targeting.
Over 17 days in August, five warnings showed how quickly the danger is changing. The next serious cyberattack may not be about stolen passwords or credit-card numbers. It could reach the systems that move electricity, pump drinking water, run factories and support hospitals.
Artificial intelligence is making those attacks faster to prepare and easier to scale. Worse: increasingly capable systems are beginning to perform parts of the attack that once required skilled hackers working step by step.
Five August developments tell the story.
1. OpenAI said the window is closing. On Aug. 10, OpenAI warned that attackers will increasingly use AI to conduct cyberattacks at “unprecedented speed and scale,” including in fully autonomous ways. Its conclusion was blunt: defenders have a “narrowing window to prepare.”
OpenAI’s own cyber-focused model, GPT-5.6-Cyber, now answers 95% of advanced exploit-development requests it used to refuse.
For defenders, every minute matters. If an attacker can find and exploit a weakness before anyone knows it exists, the opportunity to patch the system may disappear before the attack begins.
HALLUSQUATTING AI ATTACK COULD HIJACK YOUR COMPUTER
2. Federal agencies said the attacks are no longer theoretical. On Aug. 19, the NSA, CISA, FBI, Department of Energy and EPA warned that cyber actors are targeting U.S.-based Siemens S7 series industrial controllers with AI-generated exploitation scripts. These controllers help operate real machinery. The sectors at risk include power, water, manufacturing, chemicals and food production.
A successful attack would not merely steal information. Federal officials warn it could interrupt industrial processes, damage equipment or create safety problems. The government calls this an active threat, not a theoretical one.
3. OpenAI disclosed a “warning shot”: an AI model escaped its test controls.
On Aug. 26, OpenAI revealed that during internal cybersecurity evaluations, models operating with reduced safeguards circumvented controls meant to isolate them, gained internet access and compromised parts of OpenAI’s own research infrastructure and Hugging Face’s systems.
This was not an enemy attack. But OpenAI’s own conclusion was chilling: without sufficient safeguards, highly capable AI agents can find and exploit weaknesses across multiple computer systems and take dangerous actions no human specifically directed.
IRAN-LINKED HACKERS SUSPECTED IN UK POWER-PLANT SHUTDOWN AFTER ALLEGED MINNESOTA WATER ATTACK
4. Trump declared a national emergency over foreign threats to America’s power grid.
Also on Aug. 26, President Donald Trump declared a national emergency to secure America’s bulk-power system from foreign threats.
His order is not specifically about AI hacking. It targets foreign-produced electrical equipment, software, firmware and remote-access capabilities that could create opportunities for sabotage or unauthorized access.
THE MACHINES THAT KEEP AMERICA ALIVE ARE FAILING. WE FORGOT HOW TO REPLACE THEM
But the AI connection is explicit. The White House says the rapid growth of artificial intelligence, data centers, advanced manufacturing and defense production has made the United States increasingly dependent on reliable electricity while magnifying the consequences of a successful grid attack.
That takes the threat out of the server room. Lose power long enough and water pumps, fuel distribution, communications, hospitals and emergency services all come under pressure.
5. More than 100 organizations said the next escalation could come within months.
On Aug. 27, OpenAI, Anthropic, Microsoft, Amazon Web Services and more than 100 other technology, cybersecurity and financial organizations issued a collective warning: “In the coming months, AI-enabled cyber attacks will become far more widespread and sophisticated.”
IRANIAN HACKERS ATTACKED OUR WATER SYSTEMS. HERE ARE 5 THINGS OUR LEADERS NEED TO DO NOW
They specifically identified hospitals, water-treatment plants and the infrastructure powering the internet as being at risk.
“In the coming months” is not Washington language for some distant future.
It is a countdown.
February’s numbers show why August’s warnings cannot be dismissed. CrowdStrike’s 2026 Global Threat Report found that AI-enabled adversaries increased their activity 89% year over year. In 2025, criminals took an average of just 29 minutes to move from an initially breached computer into other systems. The fastest observed breakout took 27 seconds.
Twenty-seven seconds is not enough time for a committee meeting, a phone call up the chain, or a traditional human response.
Anthropic showed where this may be heading. In a controlled test, its Claude Mythos Preview was told to look for a security weakness. Without step-by-step human help, it found a 17-year-old flaw, figured out how to exploit it and took complete control of the computer. The machine performed work that once demanded a highly skilled hacker.
America must also assume hostile governments are watching the same technological curve. U.S. agencies identified Volt Typhoon as a Chinese state-sponsored hacking campaign that gained long-term access inside American communications, energy, transportation and water networks. Officials assessed with high confidence that Beijing was positioning itself to disrupt critical services during a future major crisis or conflict with the United States, not simply gathering intelligence. Those are the same power and water sectors named in the Aug. 19 federal warning.
The Chinese strategy already exists. AI is the accelerant.
During a confrontation over Taiwan, China would not have to shut down the entire country. Disrupt several ports, rail systems, electrical facilities or communications hubs and the effects could cascade. Add convincing false reports that drinking water is contaminated, hospitals are failing or fuel is running out, and panic could spread faster than the physical damage.
I have warned in three recent books that AI compresses decision time and multiplies an adversary’s reach. August turned that warning operational.
America must harden the targets now. Find exposed industrial systems. Patch known weaknesses. Require strong authentication. Separate operating networks from unnecessary internet access. Help smaller utilities that cannot afford their own cyber armies. And make sure essential services can still operate when digital systems fail.
But a stronger wall is not deterrence. Washington must also improve attribution, preserve credible offensive cyber options and convince Beijing, Moscow, Tehran and their proxies that an attack on essential American infrastructure will carry consequences.
This is not another Silicon Valley story about the latest AI model.
It is about whether the lights come on when you flip the switch, water flows when you open the tap and the emergency room functions when your family needs it.
It is about whether the United States can still move forces and fight a war during a national crisis.
Five warnings landed in 17 days.
Washington should not need a blackout to take the hint.
