Over the past decade, cybersecurity has evolved from a background concern into a foundational requirement for running modern energy systems. But every so often, an event comes along that fundamentally reshapes our understanding of risk.
Earlier this month, a major frontier-model provider published findings from the first documented AI-orchestrated cyber espionage campaign, and the implications reach every corner of critical infrastructure, and energy systems are uniquely vulnerable.
If the ERCOT market taught us why location is everything, this incident teaches us something even more critical for the AI era: trust is everything.
A new kind of adversary
Historically, cyberattacks followed a predictable pattern. Human operators probed systems, looked for vulnerabilities, and moved through networks manually. That model has shattered.
In this campaign, a state-sponsored threat group used AI agents—acting through role-playing and orchestration—to autonomously conduct nearly 90% of the attack workflow.
The AI scouted targets, discovered vulnerabilities, built exploit chains, harvested credentials, analyzed stolen data, and wrote reports for the human operators. What once required a team of experts working for weeks now takes a single operator supervising a fleet of automated agents in hours.
This wasn’t theoretical. It wasn’t a simulation. It was live, coordinated, and effective.
The shock isn’t that AI was misused. The shock is how quickly it learned to operate like a scalable workforce of elite attackers.
The identity crisis in distributed energy
Energy systems—especially distributed ones—are uniquely exposed to this new threat model.
Wind farms, solar arrays, batteries, EV chargers, inverters, home hubs, industrial control systems, and data aggregation services all form an expanding attack surface. Historically, industry defenses leaned on perimeter security, VPNs, and segmented networks. But AI doesn’t care about perimeters. It moves laterally, reasons about topology, and adapts faster than human defenders can track.
Consider a scenario: an AI agent compromises a single smart inverter, uses it to map the entire distributed energy network, then systematically harvests credentials from thousands of endpoints—all before the first alert fires.
Most importantly, today’s energy devices were not built to provide strong, verifiable identity. They assume the network is trustworthy. They assume the device saying “I’m a DER controller” is the DER controller. In an environment where AI can generate convincing credentials, proxies, payloads, and data streams at machine speed, those assumptions no longer hold.
The report makes this clear: the next generation of cyber threats will target identity, data integrity, and control pathways, not firewalls.
New security frontier: explicit trust
The takeaway is simple: The energy sector needs to shift from trust-by-assumption to trust-by-verification.
That means every device, service, dataset, model, and AI agent must be:
- Cryptographically authenticated
- Bound to a provable origin
- Governed by machine-enforceable policies
- Resilient to impersonation or spoofing
- Traceable across its full lifecycle
This is the same transformation finance went through with secure transactions, and the same shift telecom underwent with SIM-based identity. Energy is next.
This isn’t aspirational, practical solutions already exist. Frameworks like TEIA—built around cryptographic identity, data provenance, and policy-driven authorization—move the industry from implicit trust to constructive trust by ensuring that every action is validated, every instruction has lineage, and every agent (human or AI) operates inside a governed trust domain.
This shift is what we call explicit trust: nothing in the system is trusted merely because it is present on the network, claims a role, or behaves plausibly. Every entity—device, dataset, instruction, or AI agent—must continuously prove its identity, integrity, and intent through cryptographic evidence.
Explicit trust replaces assumption with verification, and it’s the only viable security posture when adversaries can fabricate identities, actions, and data at machine speed.
A turning point, not a footnote
We’ll look back on this campaign the same way we look at the first large-scale cloud breach, the Stuxnet incident, or the early ransomware epidemics. It will mark the moment when the cybersecurity status quo became obsolete.
Just as the ERCOT pricing signals forced the industry to rethink grid participation, AI-driven cyber operations will force us to rethink trust itself. Energy companies that adapt early—building trust foundations into devices, data pipelines, and operational platforms—will not only reduce risk; they’ll unlock new forms of automation, interoperability, and market opportunity that were previously impossible.
Because in a world where AI can impersonate anything, scale infinitely, and adapt on the fly, explicit trust is the only thing that still matters.
About Julian Durand
Julian Durand serves as Chief Security Officer and General Manager of Secure Systems at Intertrust. He earned his engineering degree from Carleton University, and his MBA from the University of Southern California (USC). He is also a Certified Information Systems Security Professional (CISSP) and inventor with 10 issued patents.