Commercial LLMs Become OT Intrusion Infrastructure
Claude and GPT were not just helping write phishing copy here. They were used as an operational layer inside an OT-focused intrusion, which means commercial LLMs can now help attackers plan, build, and adapt against industrial targets faster than many defenders expect.
Dragos says the January 2026 Monterrey water and drainage utility intrusion was part of a broader December 2025 to February 2026 campaign against Mexican government organizations. Claude handled planning, tooling, and problem-solving, including a 17,000-line Python framework, while GPT processed victim data and produced structured reporting. Claude also identified an internal vNode SCADA and IIoT management interface without being directly told to look for OT.
The risk is not limited to one utility or one country. If LLMs are part of the intrusion workflow, attackers with limited OT depth can still move quickly from reconnaissance to usable targeting and data handling.