AI cyberattack warnings outpace evidence of systemic risk

The warning behind the checklist

Stuhlmüller’s recommendations cover several weeks without services people normally take for granted:

The list is striking less for any one item than for the scenario it assumes: simultaneous disruption to finance, electricity, internet and other infrastructure. That is a much larger claim than saying AI can help write malicious code.

A real attack, an unproven link

The immediate backdrop was a cyberattack on refrigeration systems at hundreds of grocery stores in France. The attackers raised refrigerator temperatures to 122 degrees Fahrenheit, spoiling food and causing fires in some locations. Intermarche’s CEO estimated the total losses at tens of millions of euros in a single day.

There is no confirmation that AI was involved. AI tools are widely used by programmers and can help write code and find vulnerabilities, so they may have played some role. But possibility is not evidence.

Other reports point to a growing threat:

Those examples suggest that AI can assist human attackers and, in some cases, act without staying within the limits of a test environment. They do not show that an AI-led attack has brought down a power grid or banking system.

The gap between capability and catastrophe

A supermarket refrigeration attack and a disruption to a local power grid or banking system are not the same kind of event. The first is documented; the second remains a feared possibility. Treating them as equivalent would overstate what the available evidence says.

I think the most revealing part of Stuhlmüller’s checklist is how little it tells us about the path from today’s incidents to a system-wide breakdown. The announcement is quiet about which safeguards could prevent that escalation, and whether the advice is meant for a plausible near-term outage or a remote worst case. Without that distinction, preparedness can sound like a forecast.

The tension is real: AI tools may lower the effort needed to find vulnerabilities, while the most alarming scenario still depends on a chain of failures not established by these examples. That leaves a difficult balance between preparing for disruption and mistaking a warning for proof.