US Water Systems Remain Exposed as Iranian Attacks and AI-Driven Threats Grow

Cyberattacks by Iranian hackers on water systems in 12 US states this summer showed how exposed the sector is to foreign adversaries. The article warns that a broad attack on water infrastructure could have consequences comparable to a public health crisis affecting the whole population. The 2026 US intelligence community Annual Threat Assessment names cyber actors from China, Russia, Iran, North Korea and ransomware groups as critical threats to networks and infrastructure.

The piece says advances in artificial intelligence have heightened the risk. Advanced AI models, including Anthropic's Claude Mythos, have shown they can identify thousands of zero-day vulnerabilities in critical software such as major operating systems and browsers. Some systems developed in China are reported to show similar capabilities. AI can now plan, test and execute attacks in rapid cycles, from minutes down to seconds.

The author points to technical and legal weaknesses. About 80% of US water systems lack even basic cyber hygiene, a gap exploited in the summer attacks. Even the roughly 450 large and 4500 medium-sized systems that serve most of the population have not adopted the advanced protections used in sectors like aviation, finance and nuclear power. Legally, the Environmental Protection Agency lacks clear authority to impose broad cybersecurity requirements. Its 2023 memo was withdrawn after opposition from the water sector and legal challenges, leaving it able to require risk assessments and emergency response plans.