The US House Homeland Security Subcommittee is investigating the escalation of AI-driven cyber-physical threats targeting critical infrastructure. Adversaries are deploying agentic AI to automate vulnerability discovery and execute autonomous attack chains, drastically reducing the time-to-exploit for ICS/OT environments to under 24 hours. Technical vectors include AI-generated polymorphic malware that bypasses signature-based EDR and deepfake-driven authentication bypass targeting critical personnel. These capabilities enable the transition from data exfiltration to kinetic disruption of power grids and water systems. Legislative efforts, specifically the "Great American AI Act" (Obernolte-Trahan), seek to establish federal guardrails and a new Center for AI Standards and Innovation (CAISI) to counter these rapid-cycle exploitation threats.

• Threat Landscape: Agentic AI and Kinetic Convergence

  • Deployment of "agentic AI" systems capable of interpreting environment states and autonomously taking actions to disrupt physical assets.
  • Compression of the vulnerability-to-weaponization timeline, with exploits appearing within 24 hours of public disclosure.
  • Shift in adversary objectives from traditional espionage toward the physical sabotage of transportation, energy, and water sectors.

• Technical Vectors: Polymorphic Malware and OT Vulnerabilities

  • Use of AI-generated polymorphic malware that mutates code in real-time to evade signature-based detection in Industrial Control Systems (ICS).
  • Failure of "detection-first" EDR models against machine-speed attacks that complete objectives before analysis cycles finish.
  • Automated reconnaissance toolsets utilizing AI to map complex OT/IoT network topologies and identify zero-day vulnerabilities.

• Authentication Vectors: Deepfakes and Social Engineering

  • High-fidelity, LLM-driven social engineering campaigns targeting infrastructure personnel to obtain administrative credentials.
  • Deepfake-driven authentication bypass used to impersonate executives or technical leads in multi-factor authentication (MFA) workflows.
  • Automated scanning and probing of critical infrastructure IP ranges to identify vulnerable entry points for agentic AI agents.

• Legislative Response: The Great American AI Act

  • Bipartisan proposal by Reps. Obernolte and Trahan to create a federal framework for AI governance and risk mitigation.
  • Establishment of the Center for AI Standards and Innovation (CAISI) within NIST to evaluate frontier models with a $300 million allocation.
  • Focus on "preemption," aiming to establish a unified federal standard for AI development to replace fragmented state-level regulations.

• Defensive Frameworks: CISA and NIST Integration

  • Implementation of the "Careful Adoption of Agentic AI Services" guide to mitigate risks from autonomous AI decision-making.
  • Deployment of "CI Fortify" guidelines, shifting to an assumed-breach model to ensure manual operation of OT during cataclysmic failures.
  • Integration of the NIST AI Risk Management Framework (AI RMF) to "Govern, Map, Measure, and Manage" AI-specific risks in critical sectors.