Claude and ChatGPT Used in AI-Assisted Attack on Monterrey Water Utility, Dragos Report Reveals

A quietly significant detail in this week's Dragos report deserves more attention than it's getting: attackers used Claude and ChatGPT to assist an intrusion attempt against a water utility in Monterrey, Mexico. The OT breach ultimately failed — but that misses the larger point. What the report documents is AI functioning as a competent reconnaissance assistant for critical infrastructure attacks: autonomously identifying a vNode SCADA/IIoT interface, recommending a password-spray attack strategy, and generating a Python toolkit on demand. No novel exploit code. No nation-state resources. Just patience and access to a chat window.

The incident marks a concrete shift in how AI tools are being integrated into offensive operations against industrial control systems. The attackers leveraged large language models to compensate for domain knowledge gaps that previously would have required specialized OT expertise. The AI didn't need to autonomously execute the attack to be useful — it lowered the reconnaissance floor, making SCADA and IIoT infrastructure more legible to adversaries who otherwise might struggle to navigate these specialized environments. Dragos notes that the threat doesn't need to be fully autonomous to be meaningful.

For operators of water utilities, energy infrastructure, and other OT environments, the Monterrey incident signals a pressure point: the barrier to entry for targeting industrial systems is eroding. Security teams that once relied on the relative obscurity and complexity of OT environments as a defensive layer may need to reassess. The combination of publicly accessible IIoT interfaces and AI-assisted reconnaissance creates a new attack surface that doesn't require sophisticated actors — only motivated ones with access to commercial AI tools. The incident also raises questions about how AI providers will respond to evidence that their products are being used to facilitate infrastructure attacks, and whether guardrails can meaningfully constrain this kind of misuse without hampering legitimate security research.