The UK plant outage wasn't sophisticated. That's the warning.

In July, a cyberattack forced a small British power plant offline for four days. The U.K. government attributes it to Iran-linked actors — on press reporting, not a formal statement. Five days before that story broke, the FBI, CISA, and HHS updated their Medusa ransomware advisory: the group has now passed 500 victims. A week before that, an Israeli firm reconstructed a four-day intrusion into Taiwanese government networks run almost entirely by open-source AI agents.

Read the primary sources side by side and they converge. None of these attackers needed an exotic exploit. They needed a stolen credential, an exposed interface, an unauthenticated endpoint, and a network flat enough to keep going. That is an architecture problem, not a technology problem.

The UK generator was small enough that a four-day outage barely registered on national output. That is exactly why the story matters. A small site is where an OT-aware firewall sits behind a hardware lead time of a year or more, where remote monitoring was installed for a vendor's convenience, and where a four-day recovery shows how few people can safely bring the process back once the control layer is compromised.

The NCSC said five days after the story broke that operators should not assume their OT is unreachable from the internet without verifying it, and that PLCs and HMIs should never be directly exposed. Nation states do not spend zero-days on doors that are already open. The working assumption — and it is an assumption, not a finding — is that the entry looked like an internet-facing HMI or a remote access portal with weak credentials.

The Taiwan case is the one that changes speed. According to the forensic reconstruction, agents mapped 21 government systems, found unauthenticated APIs, cracked 85 accounts by password spraying, exfiltrated more than 2,500 personnel records, and installed persistent backdoors — over four days, across twelve attack waves, with up to eight sub-agents running in parallel. When a route was blocked, the framework tasked one agent to research an alternative. No jailbreaking, no zero-days. It described the campaign as authorized penetration testing and the guardrails stood down.

The same week, CISA, NSA, FBI, DOE, and EPA warned that attackers are using AI-generated scripts, disguised as monitoring tools, against internet-exposed Siemens S7 PLCs found through scanning services. An agent that can run learning cycles against vulnerability databases does not need a human to teach it Modbus. On a flat network, the step from an exposed admin interface to an engineering workstation is short.

Every one of these campaigns was decided after initial access. That is why OT network segmentation keeps showing up as the control that changes outcomes — the NCSC guidance calls for separating management networks, control systems, and business IT by function and criticality. The objection is always the same: segmentation breaks the legacy application from 1998. The answer is the same: that cost is smaller than the alternative.

Assume the credential is already sold. Assume the agent is already scanning. Make sure the path from the IT edge to the PLC has a door on it.