(TNS) — Artificial intelligence is moving into the computer networks that help operate and protect the nation’s electric grid, and federal energy regulators are warning that the technology could create new pathways for hackers to reach systems critical to keeping the power on.
The warning came last week from the Federal Energy Regulatory Commission, whose cybersecurity auditors said they observed increasing use of artificial intelligence tools in protected network environments supporting the bulk power system.
The same day, Connecticut Attorney General William Tong and Consumer Counsel Claire Coleman asked the Public Utilities Regulatory Authority to investigate how the state’s electric, gas and water utilities are using artificial intelligence and what safeguards they have in place.
Officials and researchers say the technology has clear potential benefits. AI can help utilities forecast electricity demand and renewable generation, identify equipment problems before failures and evaluate transmission investments. But the consequences of mistakes can be significant when increasingly capable software is connected to critical infrastructure.
“The tech industry has been pretty reckless about AI testing and deployment, and I think we have good reason to be concerned about how these systems are being introduced into critical infrastructure,” said Sean O’Brien, director of the Cybersecurity and Computer Science Programs at Yale University and founder of Yale’s Privacy Lab.
At the same time, O’Brien said, some of the discussion about AI risks can obscure a more familiar cybersecurity problem.
“We’ve always had trouble keeping complex software secure, especially when it’s connected to the Internet around the clock,” he said. “What’s different now is that companies are giving these systems unrestricted access and more opportunities to operate at a massive scale.”
WHAT CONNECTICUT WANTS TO KNOW
Tong and Coleman say the extent and scope of AI use by Connecticut utilities are unclear, even though Eversource and Avangrid have publicly acknowledged using the technology.
“It’s not a question of whether our utilities are using AI — we know they are,” Tong said. “We need to know exactly where, why and how it is being deployed, and what safeguards are in place to ensure the security and stability of our critical energy systems and infrastructure.”
Their petition asks PURA to require utilities to identify the AI systems they use, explain the objective of each system, describe the level of human oversight and provide the policies, procedures and protocols governing their use.
The proposed review would cover storm response, customer systems, asset management, energy-load and water-demand forecasting, equipment procurement, grid and power plant operations and maintenance, third-party vendors and advanced metering infrastructure.
It also asks PURA to review data-security and cybersecurity protections and breaches “both stemming from AI and outside of AI.”
Vahid Behzadan, an associate professor at the University of New Haven who studies AI safety and security, said the questions fall into three broad categories: cybersecurity and privacy, operational reliability and consumer protection.
AI can help utilities make decisions, Behzadan said, but the safeguards should reflect the consequences of getting something wrong.
A model that performs well under ordinary conditions may behave differently during an unusual storm or emergency, he said, when accurate information may matter most.
The Connecticut petition cites concerns about AI weather forecasting, including a California wildfire forecast and models used during a February nor’easter. The petition acknowledges that it is unclear whether utilities in the Northeast used AI models to predict that storm.
Behzadan said utilities should test AI systems against extreme conditions rather than assuming strong performance during normal circumstances will continue during emergencies.
There is also a significant difference between AI helping an engineer analyze a problem and AI taking an action that affects the grid.
“As its authority increases, so should independent testing, human oversight, and access to tested fallback procedures,” Behzadan said.
Simply putting a human somewhere in the process does not necessarily solve the problem.
“Having a human ‘in the loop’ means little unless that person has the information, time, and authority to intervene,” he said.
That distinction could become increasingly important as AI moves from providing information to performing tasks.
WHAT FERC FOUND
The Federal Energy Regulatory Commission’s 2026 cybersecurity audit report says its auditors observed increasing use of what the agency calls “super intelligence” tools — including chatbots, personal assistants and automated analytical systems — in protected network environments associated with systems covered by federal Critical Infrastructure Protection requirements.
“Although these tools can improve operational efficiency, their evolving capabilities may introduce access control risks when access is not properly authorized, verified and monitored,” FERC said.
The agency warned that AI systems can also make malicious activity harder to distinguish from normal activity.
“SI tools may mimic user behavior, making it harder to distinguish legitimate activity from malicious use and complicating detection and response,” the report said.
If not properly controlled, FERC said, the tools could create “unanticipated lateral-movement vectors” or enable unauthorized access to protected electric-grid systems. Lateral movement refers to an attacker using access to one compromised system to move deeper into a network.
FERC said recent intrusions have shown that commercially available AI tools already residing on utility systems can be used to “map environments, identify pathways toward critical systems, accelerate reconnaissance, and automate exploitation attempts.”
The report did not identify the entities involved in the audits. FERC said it examined several U.S. entities registered with the North American Electric Reliability Corporation, which oversees mandatory reliability standards for the bulk power system. The agency also highlighted a growing role for third-party vendors.
FERC said entities told auditors that vendors and suppliers are increasingly adding AI capabilities to their products and services while utility compliance programs have been slower to adapt. In some cases, the agency said, entities did not fully understand the scope and capabilities of AI tools until products were already active on their networks.
That makes a basic question particularly important, O’Brien said: What does the software actually have permission to do?
“Is it isolated from sensitive networks? Has it been properly tested? Who is monitoring its activity?” he said. “We have decades of experience with operating system, network and physical security controls that can keep software from doing things it shouldn’t.”
The problem, O’Brien said, is that companies have spent years moving toward increasingly interconnected systems and cloud computing, sometimes weakening traditional protections along the way.
“I don’t think we should treat AI as some mysterious new threat that we have no idea how to control,” he said. “Much of the danger comes from companies choosing not to use the security measures we already have.”
THE CUSTOMER-FACING QUESTION
The proposed PURA review would also cover customer systems in Connecticut, bringing AI risks closer to the everyday experience of utility customers.
A chatbot might help a customer understand a bill or find information about a payment plan. But a confidently wrong answer about a bill, payment arrangement, shutoff protection or restoration estimate could have real consequences.
“Those systems need testing on high-stakes questions and an easy path to a human,” said Behzadan, from the University of New Haven.
The petition also asks PURA to examine advanced metering infrastructure.
Smart meters can generate detailed information about when electricity is being used. Behzadan said those patterns can potentially reveal household routines and occupancy.
That information deserves particular scrutiny if it is fed into AI systems operated by third-party vendors, he said.
ISO New England, which operates the region’s bulk power system, said it uses security, monitoring and risk-management practices to protect critical infrastructure but declined to discuss specific cybersecurity measures or internal operational practices.
“ISO New England continuously evaluates evolving technologies and cybersecurity risks, including those associated with artificial intelligence, as part of its responsibility to operate the region’s bulk power system reliably,” spokesperson Emma McCorkindale said.
O’Brien said protecting sensitive technical information does not mean utilities and grid operators cannot explain the broad purposes of their AI systems, how they are tested and who is accountable for them.
“I’m not a fan of ‘security by obscurity’ and it’s a very, very slippery slope to hide tech info from the public in the name of national security,” he said.
He also raised concerns about utilities becoming dependent on proprietary software that cannot be independently inspected or audited.
Behzadan, too, said utilities should “be able to explain its AI systems’ broad purposes, limits, testing, and accountability without disclosing technical details that would help an attacker. Protecting sensitive infrastructure information is compatible with meaningful public transparency and independent scrutiny.”
Eversource said it supports a review of utility AI use, although it did not provide details about its current applications.
“Although we’re still assessing Attorney General Tong and Consumer Counsel Coleman’s petition to PURA, we are fully supportive of a transparent and collaborative evaluation of the use of artificial intelligence to ensure there is a secure and aligned process for all parties and utilities working on important matters for Connecticut customers,” spokesperson Jamie Ratliff said.
Eversource said it looks forward to participating in the review “so that the technology can be used safely and to the benefit of the residents and business owners we serve.”
ACCOUNTABILITY
The Connecticut petition does not allege that artificial intelligence has caused a cybersecurity breach or operational failure at a Connecticut utility.
Instead, Tong and Coleman are asking PURA to determine where the technology is being used, what it can access, what authority it has and whether existing safeguards are sufficient.
Coleman said AI could improve utility operations and create savings for customers, but said those benefits cannot come at the expense of safety, reliability or consumer protections.
O’Brien said the technology should not be treated either as an inevitable threat or as something that can be deployed without scrutiny.
“Ultimately, I think this comes down to accountability,” he said. “We shouldn’t be letting companies experiment recklessly with infrastructure that millions of people rely on.”
“The technology can be useful, and we know how to make it safer,” he said. “We just need to make sure the folks deploying it are actually doing the hard work of proper security controls.”
©2026 CT Insider, Distributed by Tribune Content Agency, LLC.