Desk live·
ForensicPost
Nation-state/AI agents/File 26-0225

The Model Found the SCADA Gateway

Research describes an intrusion at a Mexican water utility in which an adversary used an AI assistant to survey the enterprise network and identify industrial systems. The capability being demonstrated is reconnaissance, not exploitation.

Constructed geometry · not a chart of case data
JurisdictionMexicothe affected organisation’s jurisdiction, not the actor’s suspected origin
TargetWater utility (Mexico)
ActorUnattributed
D. Kennedy12 min readConfidence: medium2 sources reviewed

Published research describes an intrusion beginning in January 2026 at a water and drainage utility in Mexico, part of a broader campaign against Mexican government organisations running from December 2025 into February 2026.

After compromising the enterprise IT environment, the adversary is described as tasking an AI assistant with intelligence-gathering across the internal network. The assistant identified a server hosting an industrial gateway and a SCADA management platform.

The Hard Part Of An OT Intrusion Is Knowing What You Are Looking At

Reaching a plant network is not usually the obstacle. The obstacle is interpretation. An operational environment presents a heap of unfamiliar hostnames, proprietary protocols and vendor-specific software, and working out which of those is a historian, which is a gateway to controllers and which is a forgotten test box is specialist knowledge.

That knowledge has historically been the natural barrier around industrial systems. It is why OT intrusions have been comparatively rare and comparatively state-associated: they required people who understood the process.

What Is Actually New, Stated Carefully

No exploit was invented here. Nothing was executed that could not have been executed before. What is described is compression of the analyst step — the interval between reaching an unfamiliar network and understanding it well enough to act.

This desk describes capability rather than novelty, and the capability is specific: general-purpose tooling now supplies context that previously required a specialist. The consequence, if it generalises, is not more sophisticated attacks on industrial systems. It is more attackers able to attempt them.

We grade this medium. The account rests on a single vendor investigation. It is detailed and internally consistent, and we have not seen it independently corroborated.

How we reported this

Compiled from published vendor research and reporting, listed below. We did not review the incident data. The account of AI assistance is as described by the researchers, and we are not characterising the vendor’s own response beyond what is published. Corrections: corrections@forensicpost.com.

Sources
  1. AI-assisted ICS attack on a water utilityDragos
  2. Claude AI guided hackers toward OT assets during water utility intrusionSecurityWeek
D. Kennedy
Identity and access reporter. Former DFIR consultant. Signal on request.
// the chain of custody — tuesdays

Get the next file first.

One incident a week, taken apart properly. Logs, timelines, and what the filing left out.

PGP-signed edition · no tracking pixels · one-click unsubscribe
© 2026 ForensicPost Media · the desk · newsletter · searchGlossary