The FBI, CIA, NSA, CISA and others issued a warning about active AI-driven attacks on American critical infrastructure. Craig, who ran the FBI's InfraGard online training program, explains what's actually exposed: old controllers that open and close valves, set flow rates, decide how much acid or base goes into the water — many of them reachable directly from the internet, on networks that have been comprehensively mapped for years. Several water systems have already been shut down; one town lost power along with its water.

Josh, who works InfraGard in his own homeland security practice, asks the right question: if an adversary can use AI to find and exploit these holes, what stops us using ours to find and patch them first?

Craig's answer is the best story in the segment. Last year a botnet was running attacks out of tens of thousands of home routers — cheap hardware bought at Staples or Walmart, full of holes. So the FBI and NSA hacked into those routers, on private home networks, and patched them, breaking the attackers' control. Our government hacked our own equipment to fix it. As far as Craig knows it has happened exactly once.

He's honest about the limits: defensive AI exists at Microsoft, Anthropic and OpenAI, but it can't help with vulnerabilities people don't know they have. And you can't change the consumer — people still buy cheap Android phones.

Also in this segment:

• Remembering Dolly Parton, who wanted to be faxed rather than called and didn't want her mind fed into an AI — alongside the Dolly Parton Experience built from lasers and technology, and hundreds of unreleased recordings
• A defense contractor employee who clicked one email and exposed the company; Craig has worked similar cases with the FBI's Boston office
• The two things to do about it: delete any program you haven't used in a while, on your phone as well as your computer, and put something like OpenDNS in front of your browsing so a known-bad link can't resolve

Free newsletter: CraigPeterson.com