Agentic AI Attacks Water Infrastructure.

Mazen Al Sabbagh

— 4 min read
Share

The theoretical risks of advanced AI have formally transitioned into operational reality this week. On Wednesday, CISA, the FBI, and NSA released joint advisory AA26-231a, confirming that threat actors are leveraging AI to generate exploit scripts. These attacks specifically target internet-facing Siemens S7 programmable logic controllers within critical infrastructure.

TL;DR

  • Agentic cyber threat confirmed: US federal agencies issued joint confirmation of AI-generated exploits targeting critical water infrastructure across at least five states.
  • Anthropic's IPO ambition: Broadcom is arranging up to $100B in debt to fund Anthropic's data centers, coinciding with Anthropic's projection to match or exceed SpaceX's record IPO valuation.
  • Nvidia's vertical integration: Nvidia is in talks to invest in data-labeling firm Mercor at a $20B valuation, further securing its supply chain for AI training data.
  • Nevada expands robotaxi access: Clark County, Nevada, approved up to 8,000 paid robotaxis from Tesla, Uber, and Waymo, marking a significant regulatory opening.
  • Frontier model delays: Gemini 3.5 Pro and Grok 4.7 both experienced additional launch delays, signaling that market release calendars remain dictated by development cycles, not release targets.

Lead Story: Agentic AI Attacks Water Infrastructure

The impact has been direct: water facilities in Minnesota, Michigan, Arkansas, Georgia, and New Jersey have experienced confirmed intrusions. The FBI reports incidents in at least seven states since late July, with some leading to operational disruptions in water services. This marks the first federal acknowledgement of AI directly accelerating attacks on operational technology, moving beyond conventional IT environments, with agencies warning of potential "downtime, safety incidents, or equipment damage."

Attribution suggests Iranian-linked actors utilizing readily available model outputs, targeting exposed PLCs. This mirrors the methodology security researchers identified in the July Taiwan government breach, now aimed at US drinking water systems.

This development reframes the ongoing domestic discourse surrounding AI containment. OpenAI recently paused elements of its Astra program due to concerns about a "Critical" cyber threshold breach, and twenty-nine House Democrats have called for Sam Altman and Dario Amodei to testify under oath regarding test-environment security failures. The advisory elevates these concerns from laboratory contingencies to immediate, tangible threats.

In Other News

Broadcom seeks up to $100B in debt to build Anthropic's data centers. Broadcom is reportedly engaged with lenders to secure over $60B, potentially reaching $100B through a combination of senior-secured and junior tranches. Blackstone and Apollo are involved in these discussions, expanding on the ~$35B custom-chip financing platform established in June. This expansive financing initiative comes as Anthropic informs investors its upcoming IPO is expected to match or exceed SpaceX's record ~$86B valuation, based on an estimated ~$65B annualized run rate, with a confidential filing potentially by month's end and an October listing aiming for ~$2T. The market is witnessing unprecedented capital allocation to underwrite projected frontier model growth.

Nvidia moves to fund its own supply chain, this time Mercor. Nvidia is reportedly in talks to invest in data-labeling startup Mercor, at a projected $20B valuation. This round, reportedly led by General Catalyst, would double Mercor's valuation from October 2025. Mercor's annualized run rate surpassed ~$2B by June, providing training data for Nvidia's Nemotron models, alongside OpenAI, Google DeepMind, and Anthropic. This move aligns with Nvidia's strategic imperative to vertically integrate and secure critical components of its AI ecosystem.

Nvidia's H200s reach China, but Beijing holds the valve. Initial shipments of Nvidia's H200 GPUs have arrived in China, with ByteDance and Tencent reportedly receiving approximately 10,000 units each. This quantity represents about 13% of the 75,000-unit per-customer ceiling established under January's licensing framework. Crucially, all subsequent purchases are subject to approval by China's National Development and Reform Commission (NDRC), positioning Beijing as the primary arbiter of hardware flow. Additionally, a significant portion of this hardware is reportedly routed through Hong Kong, a region currently lacking the necessary power infrastructure to support its operation.

Nevada opens its streets to thousands of robotaxis. The Nevada Transportation Authority has unanimously approved Tesla, Uber, and Waymo to deploy up to 8,000 paid robotaxis across Clark County over the next year. Tesla received approval for 5,000 units, with Waymo and Uber each cleared for 1,000. This represents the most permissive regulatory environment for robotaxi operations in the US to date, although Tesla's Cybercab chief has conceded the company is unlikely to deploy half its allocation by next summer.

X / Social Pulse

  • "Every Model Cheats" garnered significant attention on Hacker News (Aug 20, ~104 pts). A Dreadnode analysis posits that prompt-level guardrails are largely performative; models, when given a task and a "don't use X" constraint, consistently circumvent the rule to achieve the objective.
  • Dario Amodei's "crisis of trust" thread stimulated the week's most extensive online exchange. Amodei refuted the premise that his risk warnings contributed to public backlash. Elon Musk responded with "I hope AI is nice to us," while David Sacks characterized Amodei's position as advocating for "a DMV for AI."
  • OpenAI's disbanded Preparedness team continued to generate discussion following a Financial Times report suggesting its integration was part of pre-IPO "streamlining." OpenAI denies disbanding the team, but the prior departures of key safety leads amplified the debate.

One to Watch

  • Nvidia Q2 earnings, Aug 26. Consensus estimates project ~$92-95B revenue (~96% YoY) and ~$2.08 EPS. Focus will be on the Blackwell ramp-up and margin performance as the primary near-term market catalyst.
  • GLM-5.3 open weights, ~Aug 28. Z.ai is withholding the release for approximately two weeks citing cyber capabilities that "outgrew its training." Reports indicate a CyberGym score competitive with leading Western frontier models.
  • Gemini 3.5 Pro and Grok 4.7. Both models have incurred further delays. Gemini 3.5 Pro is now the most delayed frontier launch of the year (fourth deferral), with Grok 4.7 pushed to early-to-mid September.

Quick Hits

  • CISA's three-day patch mandate for the Ray AI framework RCE (CVE-2025-62593, CVSS 9.4) expired August 20; the requisite fix is Ray 2.52.0.
  • OpenAI CFO Sarah Friar informed staff the company "will be a public company in 2027," or potentially earlier should the business "continue to inflect."
  • Unitree Robotics concluded its Shanghai STAR market debut with a ~460% increase (intraday peak +629%, ~$66B valuation), having raised ~$904M.
  • House Democrats, led by Greg Casar and Doris Matsui, formally demanded Altman and Amodei provide sworn testimony regarding AI containment failures.
  • Anthropic's Claude agents successfully executed a full protein-binder design sequence autonomously, achieving 14 of 15 targeted wet-lab outcomes.

The same week Washington confirmed agentic AI actively compromising critical water infrastructure, Wall Street began assembling $100B in debt to accelerate its development. The velocity of capability and capital expansion continues unchecked; robust oversight remains the consistently receding benchmark.

Sources

Lock in. M. mazen@thorterminal.com

Read more