Assessing the risk of AI-enabled cyberattacks on the power grid
As AI systems become more capable, a key question is whether they could enable devastating cyberattacks. Several AI companies have committed to implementing significant safety mitigations prior to deployment, if their systems could meaningfully increase the risk of catastrophic harms. However, few quantitative threat models exist connecting specific AI capabilities to these harm thresholds. This report develops such a model for cyberattacks against critical infrastructure.
This report asks whether AI systems could enable a cyberattack on the US power grid causing $100 billion in economic damages. We focus on the power grid because blackouts have historically caused significant economic costs, and we have good empirical data from past incidents to ground our analysis. We use the $100 billion threshold for two reasons: it aligns with the quantitative definition of catastrophic risk in several AI safety frameworks, and prior scenario modeling has found that such damages are plausible for worst-case grid cyberattacks. We focus on catastrophic-level harms because they may warrant particularly stringent risk management—harms below this threshold remain important, and should not be overlooked in AI risk management.
We argue that, for AI to meaningfully increase the risk of such attacks, it would need to lower the significant barriers facing unsophisticated actors. We find this would require an extremely high level of AI capability—systems capable of automating most of the work of a large team of cyber-operatives with diverse skills. Systems meeting this threshold would likely have transformative impacts on society far beyond this threat model. We conclude that the $100 billion grid cyberattack scenario may not be well-suited for grounding AI safety policies, since the capability threshold is so high. In the immediate term, efforts to manage cyber risks may be better directed at threat models where catastrophic harms are bottlenecked by narrower technical capabilities.
