The Horde Found the Pipes

Another data point....Yesterday I wrote The Horde Is at the Wall and the CISO version.. The Model Behaved. The Attack Still Worked.

The larger argument was that we keep treating these AI and cybersecurity events as isolated incidents when they increasingly look like points on the same curve: more capable actors, more autonomy, more speed, pressing against infrastructure and institutions that were built for a slower world.

Then this landed.

WIRED is reporting that cyberattacks have hit water and wastewater utilities across at least seven states, with more than 30 utilities reportedly affected in Minnesota alone. In some cases, digital controls were disabled badly enough to result in boil-water notices.

Federal authorities suspect Iranian-affiliated hackers.

This is not an AI attack, and that's precisely why I'm adding it to the record.

The attackers appear to be targeting internet-connected programmable logic controllers — the industrial systems that sit between software and actual pumps, valves and physical processes. Federal guidance is once again telling operators to remove exposed controllers from the internet, strengthen passwords and restrict who can connect.

That is the other half of the equation.

We're rapidly increasing the amount of intelligence, automation and eventually autonomous agency available to attackers at the exact moment we continue discovering how much of the physical world is reachable through infrastructure protected by assumptions from another era.

Water.

Power.

Factories.

Transportation.

Telecommunications.

We spent decades connecting the digital world to the physical world because connectivity made everything better.

Now we're changing the nature of the actors able to navigate those connections.

The important thing here isn't Iran.

It isn't even water.

It's the pattern.

Another weak point.

Another connected system.

Another reminder that the barrier between "cyber" and the physical world is mostly imaginary. That's why I'm going to keep logging these. Not every incident deserves a manifesto. But the dataset matters.

One point is an anecdote. Two points are interesting. Enough points become a trajectory. The intelligence is accelerating. The wall isn't.

And apparently, the wall has plumbing.

---

Rich Washburn is a technologist and strategist working at the intersection of AI, infrastructure, and capital. He is Managing Partner and Chief AI Officer at Eliakim Capital.