Artificial intelligence is rapidly entering the computer networks that help run and protect the United States’ electric grid, and federal regulators are warning that this shift could create new openings for hackers. The Federal Energy Regulatory Commission (FERC) said its cybersecurity auditors found increasing use of advanced AI tools—including chatbots, digital assistants, and automated analytics—inside protected network environments linked to the bulk power system. While these tools can improve efficiency, FERC cautioned that poorly controlled AI access could allow attackers to move through utility networks and reach critical systems.
FERC’s 2026 cybersecurity audit report says AI systems may mimic normal user behavior, making it harder for security teams to distinguish legitimate activity from malicious use. The agency also warned that commercially available AI tools already installed on utility systems could be used to map networks, identify routes toward critical infrastructure, accelerate reconnaissance, and automate exploitation attempts. If access is not properly authorized, verified, and monitored, AI could create “lateral-movement vectors,” meaning hackers could use one compromised system to reach deeper parts of the grid.
The warning has prompted action in Connecticut. Attorney General William Tong and Consumer Counsel Claire Coleman have asked the Public Utilities Regulatory Authority (PURA) to review how the state’s utilities use artificial intelligence. They said the exact scope of AI deployment by Eversource and Avangrid remains unclear, even though both companies have publicly acknowledged using the technology. Tong said the issue is not whether utilities are using AI, but where, why, and how it is deployed—and what safeguards protect the state’s critical energy infrastructure.
The proposed review would require utilities to identify their AI systems, explain each system’s purpose, disclose the level of human oversight, and provide the policies governing its use. It would cover storm response, customer systems, asset management, energy-load and water-demand forecasting, equipment procurement, grid and power-plant operations, third-party vendors, and advanced metering infrastructure. The petition also asks PURA to examine cybersecurity protections and breaches, including those connected to AI and those arising outside AI systems.
Experts say the central issue is the difference between AI assisting human operators and AI taking actions that affect the grid. University of New Haven researcher Vahid Behzadan said that as AI gains more authority, it should face stronger independent testing, human oversight, and tested fallback procedures. Coleman acknowledged that AI could improve utility operations and reduce costs for customers, but argued those benefits must not come at the expense of safety, reliability, or consumer protection.
