44-Year-Old Nuclear Reactors Face Human Hackers, Not Rogue AI

As the energy transition integrates more digital controls and distributed assets onto the grid, the sector's legacy systems remain its weakest link. The average US nuclear reactor is 44 years old and was never designed for internet connectivity, making the clean-energy backbone an inviting target for human attackers wielding AI. This is not a sci-fi rogue-AI problem; it is an infrastructure resilience problem that climate policy and grid modernization must confront together.

The Verge's September 2026 dispatch cuts through the AI doom cycle with a sobering reminder: the most pressing cybersecurity risk to energy systems is not a rogue AI agent flipping breakers, but human attackers using increasingly powerful generative AI tools against infrastructure that was never built to withstand modern threats. Joshua Corman, executive in residence for public safety and resilience at the Institute for Security and Technology, frames the historical reality bluntly: energy systems have always been prey, surviving largely at the appetite of their predators. The recent spate of high-profile hacks and even warnings from AI executives about a 10 percent chance of artificial intelligence killing all humans have not changed his primary concern. Instead, Corman and other cybersecurity experts interviewed by The Verge point to generative AI in the hands of bad actors as the true force multiplier.

“

Joshua Corman, executive in residence for public safety and resilience at the Institute for Security and Technology, frames the historical reality bluntly: energy systems have always been prey, surviving largely at the appetite of their predators.

The structural vulnerability is a legacy problem decades in the making. Much of the critical energy infrastructure that keeps lights on, refrigerators running, and hospital devices powered was designed before internet connectivity was a consideration. Power plants have lifespans measured in decades, and the average nuclear reactor in the United States is now about 44 years old. These systems were built with safety and reliability in mind, not cybersecurity. As utilities digitize operations and add networked controls to aging operational technology, they expand the attack surface without retrofitting the security architecture. Adversaries have mapped these weaknesses for years, and the Department of Homeland Security has previously warned that Iranian actors and sympathizers could target the United States with cyberattacks.

Generative AI changes the economics of exploitation. Corman's assessment that "any sociopath that wants to [attack] is now more powerful than they used to be" captures the asymmetry. Previously, sophisticated attacks required specialized skills in malware development, network reconnaissance, or social engineering. Today, large language models can assist with phishing lures, code generation, vulnerability research, and even operational planning. The barrier to entry has fallen, and the speed of attack development has increased. This does not mean rogue AI agents are irrelevant. Recent demonstrations of autonomous AI systems orchestrating complex cyberattacks have captured attention, and some AI executives openly debate whether their creations could trigger an apocalypse. Yet the experts The Verge consulted remain more worried about human-directed activity because it is already occurring at scale.

The rogue-AI narrative, while dramatic, may distract from the more immediate and addressable problem. Corman's framing emphasizes that regardless of whether the attacker is a human, a machine, or a hybrid of the two, utilities will have to shore up their defenses. The convergence of aging infrastructure, expanding connectivity, and AI-augmented attackers creates a race condition for the energy sector. Defenders can also use AI for anomaly detection, threat hunting, and faster incident response, but the legacy OT environment complicates deployment. Many industrial control systems cannot be easily patched, logged, or instrumented without risking operational disruption.