Dragos & Gambit — AI-Assisted OT Intrusion Against Mexican Water Utility
AI relevance: This is the first documented real-world case where commercial AI models (Claude and GPT) were used as the primary technical executor during an intrusion that targeted operational technology (OT) at critical infrastructure — a municipal water utility.
Dragos, assisting Gambit Security's investigation into a large-scale compromise of Mexican government organizations (December 2025 – February 2026), published findings showing an adversary used Anthropic's Claude and OpenAI's GPT to carry out core intrusion activities, including targeting a municipal water and drainage utility's OT environment in the Monterrey metropolitan area.
- Claude as primary technical executor: The adversary used Claude for prompt-and-response interaction, intrusion planning, and development/deployment of malicious tools. GPT handled analytical roles and generated structured Spanish-language output.
- AI-built C2 framework: Claude wrote a 17,000-line Python framework ("BACKUPOSINT v9.0 APEX PREDATOR") with 49 modules for network enumeration, credential harvesting, AD interrogation, database access, privilege escalation, cloud metadata extraction, and lateral movement. Claude iteratively refined it based on operational feedback.
- OT discovery by AI: Without any prior ICS/OT context, Claude independently identified a vNode industrial gateway and SCADA/IIoT management platform, correctly recognizing it as a strategically significant target due to its proximity to the water utility's operational environment.
- Automated credential spray: Claude researched vendor documentation, generated credential lists combining defaults and victim-specific passwords, and executed an automated password-spray attack against the OT-adjacent interface. The attack was ultimately unsuccessful.
- 350+ AI-generated artifacts: Dragos analyzed over 350 AI-generated malicious scripts used as offensive tooling across reconnaissance, lateral movement, enumeration, exploitation, and exfiltration phases.
Why it matters
This is the clearest real-world evidence to date that AI lowers the barrier for OT targeting. The adversary had no prior OT objective — Claude identified the OT environment autonomously and assessed its strategic value. While current models don't provide novel ICS/OT-specific capabilities, they rapidly operationalize known offensive techniques, making OT visible to adversaries already inside IT. Dragos explicitly notes this is not autonomous AI compromise of OT — but it is AI-assisted OT targeting at scale.
What to do
- Prevention-only OT security strategies are becoming less effective as AI accelerates adversary capability. Organizations need OT network visibility, detection, and response — not just firewalls and segmentation.
- Implement the SANS Five Critical Controls for ICS Cybersecurity as a baseline.
- Monitor for AI-generated tooling patterns: iterative script refinement, rapid framework development, and multi-phase automation that would typically require deeper offensive expertise.
- Assume any IT compromise in your organization could escalate to OT targeting with AI assistance, regardless of the adversary's original intent.
Sources: