An agentic intrusion that reached Hugging Face production through a public code-evaluation harness, and the disclosure, forensics, industry response and policy backdrop over the four weeks that followed.
27 stagesMay 7 – Aug 31, 2026AttacksActiveDragos documented the first public case of commercial LLMs — Anthropic's Claude as the technical workhorse, OpenAI's models in support — used to run an intrusion at a Mexican water utility, with Claude autonomously pursuing an OT/SCADA interface. It lands amid a wave of (non-AI) attacks on US water systems and a state and federal response now taking shape.
6 stagesMay 6 – Aug 31, 2026