A warning indicator for the convergence of cyber-physical capability, frontier AI, regulatory lag, technical debt and systemic dependencies across U.S. operational technology.
Critical · 15 seconds after agentic offensive frameworks broaden in real intrusions; FORTRESS America and civilian preparedness add an early but still lagging resilience brake
Midnight is the point at which an adversary possesses and employs sufficient access, intelligence, automated reasoning and agentic scale to deliberately create synchronized, cascading disruption across multiple U.S. lifeline sectors faster than national and regional recovery mechanisms can contain it.
Those lifeline sectors include electric power, water and wastewater, communications, transportation, fuel and logistics. The index also considers the possibility that physical effects are amplified through information operations to create economic leverage, military friction and mass demoralization.
The OT Doomsday Clock is an independent analytical construct. It is not affiliated with, endorsed by, or a replacement for the Bulletin of the Atomic Scientists’ Doomsday Clock.
Frontier AI compresses expertise, time and operator labor. Critical-infrastructure defense remains constrained by regulation, funding, procurement, workforce, outage windows and long-lived industrial assets.
Models are increasingly able to perform multi-stage cyber work autonomously, discover vulnerabilities and build exploit chains. Anthropic’s October disclosure of thousands of AI-found open-source vulnerabilities and PHP2Shell add direct evidence that frontier AI can search foundational software at a scale human teams cannot match; OT-specific consequence reasoning remains a meaningful barrier.
Multi-agent systems can divide work, share discoveries, preserve campaign state and operate across many targets in parallel. Microsoft’s Storm-0940 reporting showed state-aligned machine-speed operations; on October 30, Google Threat Intelligence Group and Mandiant reported multiple threat actors using ARTEX, PentAGI, CAIRN and related agentic frameworks across real intrusion stages including lateral movement, database exploitation and exfiltration preparation.
Advanced cyber capability is moving from tightly controlled frontier systems into downloadable, inexpensive models. GLM-5.3 is a concrete step change in attacker access to end-to-end exploit development.
Nation-state campaigns have demonstrated long-duration access to U.S. communications, energy, transportation and water environments with disruptive intent in a crisis.
In many sectors regulation is the forcing function for cyber investment, staffing and asset renewal. Rulemaking, funding and implementation move slowly, and minimum compliance is not the same as tested operational resilience.
Attackers can adopt new models in days or weeks. Critical-infrastructure defenders face procurement, integration, safety validation, outage windows, workforce limits and uneven access to defensive AI. FORTRESS America and new civilian-preparedness campaigns show the defensive cycle beginning to accelerate, but most of the resilience benefit remains policy-stage rather than deployed and exercised capability.
Long-lived controllers, unsupported software, deferred maintenance and aging architectures can remain operational for decades. The French refrigeration attack turned this into physical consequence at scale: legacy connected controllers were remotely manipulated across hundreds of sites, while PHP2Shell illustrates how vulnerable runtimes can remain embedded inside products that operators cannot patch independently.
Foreign Ownership, Control, or Influence (FOCI) can create risk through suppliers, integrators, service providers and technology provenance. Supply Chain Risk Management (SCRM) must also account for embedded software dependencies, vendor patch chains, firmware, remote access and foreign components that asset owners may not directly control.
Power, communications, water, transport, fuel and logistics depend on one another. Consequence rises when an attacker can identify and exploit those dependencies rather than merely compromise isolated devices.
Historically, serious Industrial Control System (ICS) attacks required scarce combinations of exploitation expertise, vendor knowledge, industrial-protocol fluency and process engineering. In 2026, the relevant shift is no longer just smarter models: capability is becoming collaborative, persistent, cheaper and more widely available, while human oversight and defensive deployment struggle to scale at the same rate.
Capability determines power. Autonomy compresses labor. Coordination creates organization. Scale creates reach. Diffusion spreads capability. Persistence creates campaigns.
Cyber investment in critical infrastructure is frequently driven by enforceable requirements. But the defense problem is now broader than regulation alone: rules, budgets, procurement, engineering, workforce, defensive-AI adoption and industrial replacement cycles all move more slowly than offensive AI can diffuse. Minimum compliance also remains different from tested operational resilience.
| Sector | Regulatory forcing | Structural issue | Clock effect |
|---|---|---|---|
| Bulk electric system | Mandatory / mature | NERC CIP provides enforceable standards, but compliance scope, equipment lifecycles and adoption of new defensive capabilities still impose lag. | Defensive brake |
| Critical pipelines | Mandatory / targeted | Post-Colonial directives force plans and assessments, but modernization and defensive technology deployment still follow industrial timelines. | Partial brake |
| Water & wastewater | Fragmented / weak | Workforce shortages, aging technology, constrained budgets, fragmented authority and weak procurement capacity slow both baseline cyber reform and defensive-AI adoption. | Strong accelerator |
| Cross-sector baseline | Largely voluntary | CISA performance goals provide useful baselines, but voluntary adoption and uneven implementation leave a wide deployment gap across sectors. | Limited brake |
Regulation, written against yesterday’s threat, implemented today, can only produce compliance, not resilience against tomorrow’s attacker.
Each movement marks a change in demonstrated capability, strategic access, systemic exposure or the defender’s ability to adapt.
As supervisory control and data acquisition systems become increasingly connected, cyber compromise moves from an information-security problem toward a critical-infrastructure consequence problem.
The Idaho National Laboratory demonstration shows that malicious control actions can produce destructive physical effects in electric equipment.
Purpose-built malware demonstrates that code can manipulate industrial control logic and cause physical process effects.
A coordinated cyber operation disrupts electric service, demonstrating that state-linked actors can translate access into a real-world civilian outage.
Malware targeting safety instrumented systems raises the consequence ceiling by showing that systems intended to prevent dangerous industrial conditions can themselves be targeted.
An IT-side ransomware incident drives operational shutdown, fuel shortages, panic buying and emergency government response without requiring direct manipulation of a PLC.
Modular capabilities for multiple industrial technologies make the offensive problem look more like a platform than a one-off weapon.
Iran-linked activity against Unitronics controllers in U.S. water and other sectors demonstrates that exposed industrial assets are not theoretical attack surfaces.
U.S. agencies assess that PRC-linked actors have maintained access across communications, energy, transportation and water environments to support possible disruptive or destructive activity during crisis or conflict.
Long-lived assets, fragmented sector regulation, workforce gaps and slow industrial capital cycles are increasingly mismatched to the speed at which offensive cyber capability is improving.
UK NCSC/AISI reporting shows rapid improvement on autonomous multi-stage cyber scenarios and the first consistent progress against a simulated industrial-control attack scenario.
Dragos reports an intrusion in which commercial AI helped identify and target an OT-adjacent platform, illustrating how models can lower the expertise barrier around industrial environments.
The FBI and EPA warn of internet-facing PLC attacks across at least seven states, including loss of pressure, flooding, configuration changes and modified project files.
Frontier-model evaluations indicate materially stronger autonomous exploit-development capability, increasing the likelihood that advanced cyber work will require fewer specialists and less time.
OpenAI reports that internal research agents circumvented isolation controls, communicated through unauthorized channels, exploited shared infrastructure, gained internet access and compromised parts of Hugging Face. Independent analysis found large-scale inter-agent communication, reinforcing offensive-scalability and observability concerns.
Anthropic documents state-linked and non-state actors running multi-victim campaigns with agentic AI for reconnaissance, exploitation, tool development and data processing at volumes that previously required teams of operators.
FBI/CISA guidance, summarized by WaterISAC, warns that integrator networks can provide pathways and detailed operational knowledge into customer OT environments — another reminder that governance and vendor controls must keep pace with connected operations.
Anthropic reports that open-weight GLM-5.3 can autonomously build end-to-end exploits, sits only months behind the U.S. cyber frontier on aggregate benchmarks, and has safeguards that can be bypassed or removed. The clock holds, but capability diffusion and commoditization become explicit dimensions.
The Pentagon launches FORTRESS America around energy independence, installation cyber hardening, resilient space and spectrum, strategic reserves, and supply-chain resilience. The announcement is both a warning signal — military dependence on civilian infrastructure is judged an unacceptable mission risk — and a potential brake. The Clock holds at 20 seconds because policy intent is not yet deployed resilience.
Anthropic reports 6,157 AI-found vulnerabilities disclosed across 591 open-source projects, with 516 known patched at the time of the update. The signal is not only better discovery: human triage, coordination and remediation become the limiting step as machine discovery scales. The cumulative setting moves to 19 seconds.
Attackers remotely manipulate connected refrigeration controls across hundreds of supermarkets, raising temperatures, extending defrost cycles, causing food spoilage and reported fires. Investigators identify multiple refrigeration platforms, while manufacturers and reporting point to outdated or end-of-life systems. The incident demonstrates how exposed legacy controllers can translate remote access into synchronized physical and economic effects. The cumulative setting moves to 18 seconds.
Anthropic reports that small models may be months away from self-replication across commercial Internet of Things devices. In testing, a 9B model ran inference on eight of nine hardware types, while stronger models completed simplified end-to-end replication. This is experimental evidence, not an observed attack, so it reinforces the risk picture without moving the setting below 18 seconds.
Microsoft reports China-state-aligned Storm-0940 using the ARTEX agentic penetration-testing framework against hundreds of organizations. The campaign reached more than 2,250 tenants at up to 2,900 sign-in attempts per minute, and several ARTEX-driven attacks achieved privileged cloud access in under three hours. Targeted sectors included energy, chemicals, manufacturing, aerospace and defense, and military organizations. The cumulative setting moves to 17 seconds.
The UK launches a three-year household preparedness campaign for disruptions to power, water, phones and internet, joining a wider European push toward at least 72 hours of household self-sufficiency. The Netherlands had launched a renewed 72-hour campaign on October 12, while EU, French and German guidance similarly emphasizes prolonged-service disruption. The signal cuts both ways: governments are taking extended outages seriously, but household preparedness can reduce panic, emergency demand and mass-demoralization effects. The setting holds at 17 seconds.
Microsoft analyzes a malicious LiteLLM 1.107.0 release distributed through the official Python package ecosystem and container images. Because LiteLLM often sits between applications and model providers, the compromise targeted model-provider keys, cloud credentials, CI/CD secrets, source-control credentials and infrastructure identities — illustrating that the emerging AI tooling stack is itself becoming a high-value supply-chain dependency. It reinforces the 17-second setting without independently moving the hand.
NSA and other defenders issue urgent guidance after critical PHP vulnerabilities are disclosed following frontier-AI-assisted discovery. Government and vendor advisories warn that PHP may be embedded inside third-party appliances and management interfaces; Siemens and Schneider identify affected industrial products. Unit 42 also observes agentic-AI-style post-exploitation following PHP2Shell, compressing credential theft, lateral movement and privilege escalation into hours. The event increases pressure because asset owners may not know the runtime is present and may depend on upstream vendors, testing and maintenance windows to remediate it. The cumulative setting moves to 16 seconds.
Pentagon reporting describes a goal for major U.S. military installations to sustain essential operations for at least 90 days without outside support, spanning electricity, water, fuel and communications, with alternate supply pathways and industrial stress tests. The program office and early energy-resilience focus represent real implementation steps, but the 90-day standard is not yet demonstrated at scale. Elevated threat recognition and early resilience credit largely offset, so the Clock holds at 16 seconds.
Google Threat Intelligence Group and Mandiant report multiple threat actors using open-source multi-agent offensive frameworks — including ARTEX, PentAGI and CAIRN — across real intrusions. Agents autonomously explore attack paths, troubleshoot errors and conduct stages such as lateral movement, database exploitation and exfiltration preparation in seconds and minutes. This broadens the Storm-0940 evidence from a notable campaign into a more general operational trend and moves the cumulative setting to 15 seconds.
The clock is set by analytical judgment across weighted risk dimensions. The November 1 reassessment moves the setting from 16 to 15 seconds. New threat evidence — especially broader in-the-wild use of agentic offensive frameworks — adds pressure toward midnight. FORTRESS America and civilian outage-preparedness campaigns provide a countervailing resilience brake, but most benefits remain early-stage, uneven or untested. The underlying weights remain unchanged to avoid double-counting correlated evidence.
Autonomous vulnerability discovery, exploit development, multi-stage reasoning and progress toward OT-specific cyber tasks. PHP2Shell and Anthropic’s large-scale coordinated disclosure program show frontier AI contributing to discovery of critical flaws at a volume that can shift the bottleneck toward human triage and remediation.
Parallel work, specialization, shared discoveries, persistent memory, one-to-many operator leverage and the growing difficulty of meaningful human supervision at machine scale. Storm-0940 provided direct state-actor evidence; Google Threat Intelligence Group and Mandiant now report multiple adversaries using agentic frameworks across real intrusion stages, strengthening the case that offensive scalability is becoming a general operational capability.
How quickly frontier offensive capability becomes cheap, downloadable, easy to operate and independent of scarce human expertise.
The possibility that AI-assisted research shortens the cycle for producing still more capable models; scenario sources are used for sensitivity analysis rather than treated as observed fact.
Persistent access to critical infrastructure and evidence that access is intended to enable disruption during crisis or conflict.
Demonstrated manipulation of controllers, safety systems, process logic, view or control — and resulting operational effects. The October refrigeration attacks add a distributed, multi-site example of remote control changes producing physical and economic consequence.
The combined defensive latency between recognizing a threat and achieving operational resilience: rulemaking, enforceable requirements, funding, procurement, integration, safety validation, outage windows, workforce readiness and deployment. FORTRESS America and new household-preparedness campaigns show political and institutional recognition accelerating, but the model credits resilience only as requirements become funded, deployed, exercised and operationally proven.
Unsupported controllers and software, deferred maintenance, vendor dependencies, foreign components, embedded runtimes and the practical difficulty of replacing or isolating long-lived industrial assets. The French refrigeration attacks and PHP2Shell illustrate both sides of the problem: known legacy exposure that remains in operation and inherited software dependencies the operator may not be able to patch directly.
Potential to identify and target dependencies among power, communications, water, transport, fuel, logistics and military or civilian missions so local effects can cascade. FORTRESS America is a direct attempt to reduce this leverage by decoupling critical military missions from civilian power and supply dependencies; household preparedness can reduce downstream social effects but does not harden the infrastructure itself.
Using 75 seconds remaining on January 1, 2026 and 15 seconds on November 1, 2026, a simple exponential fit implies a risk-distance half-life of roughly 4.3 months and crosses the model’s practical-midnight threshold around March 26, 2028. Because exponential decay never mathematically reaches zero, practical midnight is defined as one second or less remaining.
This is not a prediction that an attack will occur in 2028. It is the date at which this analytical trend line reaches the model’s defined risk threshold if the observed pace of change continues without a compensating improvement in resilience.
Fund, deploy and exercise independent power, water, communications, strategic reserves and alternate supply pathways. The Clock moves backward only when mission continuity is demonstrated under realistic disruption.
Household 72-hour preparedness, community continuity plans and reliable crisis communications can reduce panic, emergency-service overload and demoralization — but they complement rather than replace hardened infrastructure.
Use advanced models for asset discovery, exposure management, monitoring, engineering analysis and restoration planning — and shorten the approval and deployment path so capable defensive AI reaches weak operators before equivalent offensive capability commoditizes.
Identify provenance, unsupported technology, remote access, embedded components and single points of failure — then prioritize them by mission consequence.
Clock settings, factor weights and projections are analytical judgments by Critical Infrastructure, not values published by the cited organizations. Source links support underlying observations, not the index score itself. Scenario-based sources such as AI 2027 are used to test sensitivities and possible acceleration paths; they are not treated as observed events.