In January, an unidentified attacker used Anthropic’s Claude and OpenAI’s GPT models during an intrusion into the IT environment of a Monterrey, Mexico, water and drainage utility, then attempted to breach a gateway associated with the utility’s operational technology (OT).
The incident was part of a broader campaign against Mexican government organizations between December 2025 and February 2026. Security firm Dragos reported that initial access likely came through a vulnerable web server or stolen credentials, although the entry point was not confirmed.
Once inside, the attacker used proxied tunnels and AI-generated tooling for reconnaissance, enumeration and lateral movement. Claude discovered an internal server running a vNode industrial gateway and SCADA/Industrial Internet of Things management platform.
The model researched the platform, identified its password-only authentication interface and generated a credential list using default and victim-specific information. Two automated password-spraying attempts failed, and investigators found no evidence that the attacker entered the OT environment or disrupted water operations.
AI accelerated familiar attack techniques
Dragos analyzed more than 350 campaign artifacts, mostly AI-generated malicious scripts. Claude developed and refined offensive tools based on their results, while GPT models processed collected information and generated structured output in Spanish.
The techniques—network discovery, credential attacks, exploitation and lateral movement—were conventional. AI reduced the expertise and time required to combine them into a working campaign.
“The key lesson from this specific example is that AI takes traditional attack vectors and executes them much faster and more aggressively,” says John Gallagher, vice president at OT and IoT cybersecurity provider Viakoo. “What at human speed would take weeks now can be done by AI in hours.”
Security teams still need to detect familiar attack behavior, but investigation and containment processes designed around human operating speeds may not respond quickly enough.
“AI didn’t endow attackers with new capabilities,” says Ram Varadarajan, CEO of cyber deception provider Acalvio. “It’s just given them speed and judgment, compressing reconnaissance that used to take weeks into minutes.”
Analysts must understand how AI can repeatedly modify tools, interpret results and select another route through the network.
IT-OT boundary exposed a route to industrial systems
The attacker didn't begin with demonstrated industrial-control expertise or an explicit instruction to locate OT. Claude found the vNode server during enterprise reconnaissance and independently recognized its relationship to the utility’s industrial environment.
Gateways, historians, engineering workstations, remote-access servers and data integration platforms must communicate across IT and OT, but they can also provide routes for investigating industrial systems. Here, the vNode interface was discoverable from the compromised IT environment and required only password authentication.
“The reliance on an internally discoverable gateway secured by a single password highlights the fatal vulnerability of single-factor internal assets in the age of agentic automated lateral movement,” says Eli Ainhorn, senior vulnerability researcher at AI security and governance provider Noma Security.
Security professionals need the architectural skills to identify every connection crossing the boundary and determine whether it's necessary. NIST recommends organizing OT assets into zones and using firewalls, gateways or data diodes to permit only explicitly authorized communications.
A properly configured industrial demilitarized zone should prevent an enterprise host from communicating directly with control-system assets. Gateways also need individual accounts, least-privilege permissions and multifactor authentication where supported. Shared or password-only access weakens accountability and makes automated credential attacks harder to contain.
Detection must account for activity originating inside IT
Because the reconnaissance originated from a compromised internal system, perimeter monitoring alone would not have detected the decisive phase.
Defenders need visibility into east-west traffic, internal scanning, gateway communications and authentication activity. Those records should be centralized so an attacker cannot erase evidence by modifying the gateway.
Gallagher points out that unusual port scanning or communications directed toward gateway ports would provide warning signs.
Detection systems should correlate the source host, attempted accounts, authentication results and prior access history. Scanning or login attempts from a corporate workstation with no history of gateway access should trigger an investigation.
“Instead of searching for unknown exploits, defenders should look for the behavioral signature of machine-speed orchestration,” Ainhorn says.
Password spraying tests passwords across numerous identities to avoid individual-account lockouts. Analysts therefore need detection logic that identifies one source attempting authentication across multiple accounts, rather than relying only on rules that count failures against each user.
The skills needed to close IT-to-OT paths
Asset discovery is the starting point: Security teams cannot protect a gateway, dual-homed server or remote connection they do not know exists. The inventory must cover firmware, credentials, certificates, ownership, network placement and communications with enterprise and industrial systems.
Security professionals also need identity engineering to replace password-only access, network architecture to enforce segmentation, OT knowledge to understand which systems can affect physical processes and threat-hunting skills to locate unauthorized bridges.
Automated cyber hygiene can identify weak credentials, expired certificates, outdated firmware and unexpected connectivity at the speed required to counter AI-assisted reconnaissance. Defensive AI and deception systems may help detect automated exploration, but they still require human oversight and an accurate baseline of legitimate operations.
Varadarajan says he expects machine-speed attacks to make automated defense increasingly necessary.
“Our ultimate defense must be machine-speed AI in reply,” he says.
Testing must account for the operational consequences of scanning and exploitation. Teams should conduct adversary emulation against representative systems, test environments or approved boundary infrastructure with OT personnel involved, rather than running aggressive tools against live controllers.
The attempted breach failed, but the next password spray may find a working credential. The objective is to remove or control the path before an attacker—human or AI—can test it.
Gallagher says the priority is automated asset discovery and cyber hygiene that provides visibility into every device and verifies that firmware is patched, passwords are strong and certificates remain valid.
“These functions must be automated to have the speed needed to defend against AI-driven threats,” he says.
The Monterrey attack demonstrates AI doesn't need to invent new techniques to change cyber risk; it can execute familiar reconnaissance, credential attacks and lateral movement at machine speed. That means up-to-date defenders must understand AI-driven threats and how automation compresses detection and response timelines.
Related certifications
- CompTIA SecAI+ builds skills in recognizing malicious uses of generative AI and using AI to strengthen threat detection, workflow automation and incident response.
- CompTIA SecOT+ prepares you for the growing security challenges facing operational technology environments