As data center demand climbs to unprecedented levels, artificial intelligence (AI) developers depend on the reliability and security of U.S. energy generation, transmission, and distribution systems. This paper examines the AI sector’s reliance on energy infrastructure and the vulnerabilities this interdependence brings. It is part of Americans for Responsible Innovation’s Invisible Backbone Series, examining nation-state threats to the critical infrastructure that underpins AI. This paper follows the series opener,1 which defines the AI infrastructure sector and identifies it as a valuable nation-state target.
We analyze the vulnerabilities of five energy nodes that can present widespread risks if interdicted: natural gas networks, large power transformers (LPTs), control systems, grid-enhancing technologies (GETs), and select data centers’ microgrids. Natural gas supplies over 40 percent of U.S. data center electricity.2 LPTs convert the high-voltage electricity zipping through interstate energy highways into lower voltage levels that data center campuses and clusters can use.3 Control systems serve as utilities’ digital nervous systems, sensing conditions and signaling grid disturbances to operators. GETs, though not yet widespread, determine how much supply can physically reach demand. And data centers’ microgrids increasingly generate, store, and distribute power internally.
Each of these nodes carries documented vulnerabilities that a threat actor can exploit to degrade U.S. AI capabilities. Natural gas pipelines rely on operational technology that can be remotely accessed. LPTs are custom-built and subject to lengthy replacement timelines of two to four years. Control systems depend on communications networks that adversaries have already penetrated. GETs display data-integrity vulnerabilities. And facility-level microgrids add new cyber entry points within the very backup systems that are meant to provide resource redundancy. Compounding these vulnerabilities, data center clusters concentrate voltage-sensitive, inflexible large loads behind energy chokepoints, where a single interdiction can cascade across many facilities.
To safeguard the infrastructure at the energy-AI nexus, the U.S. government must designate AI as a critical infrastructure sector to open a security coordination mechanism between the AI industry, federal agencies, and energy stakeholders; grant Sector Risk Management Agencies (SRMAs) the authority to set baseline security standards for vulnerable infrastructure; run wargames to sharpen cross-sector threat detection and response; and create reliability standards for data center loads, compelling utilities and data center operators to deploy secure-by-design control systems and GETs in areas serving data center clusters.
Over the last decade, Berserk Bear—a Russia-linked threat actor—has permeated energy infrastructure backbones to conduct reconnaissance on U.S. industrial systems.4 In December 2015, the attackers sent seemingly innocent New Year’s Eve invitations to energy sector workers. Once these jovially masqueraded emails were opened, the attached document leaked the victim’s network credentials into a separate server, where Berserk Bear recovered the passwords. The group then used these credentials as camouflage to enter the organization’s internal networks. Simultaneously, Berserk Bear compromised the websites that energy workers frequently visited by using trojanized software to penetrate walled networks and installing backdoors to give the attackers access to their victims’ computers. Once inside the walled cities of peripheral organizations, Berserk Bear conducted reconnaissance and opened the door to their intended victims’ systems.
Once again, the group gathered unsuspecting users’ credentials. Now inside the targets’ networks, Berserk Bear surveilled operations and secured access to the corporate network servers housing data from energy facility control systems. In the most successful instances, the attackers gained sufficient access to screenshot their targets’ control panels.5 Eric Chien, a Symantec cybersecurity analyst, noted, “You’d take these sorts of screenshots to understand what you had to do next, like literally which switch to flip.”6 This operation went on for years, permeating intertwined U.S. systems to target critical infrastructure, exploiting vulnerabilities in one sector (information technology) to target another (energy).
But Berserk Bear was not the only actor burrowing into U.S. networks. In 2024, a government advisory revealed that the People’s Republic of China (PRC)-linked Volt Typhoon group had pre-positioned its access within U.S. critical infrastructure networks, creating the conditions for a sudden, widespread attack.7 Meanwhile, PRC-linked Salt Typhoon was conducting an espionage campaign and compromising U.S. telecommunications companies’ networks to steal customer call records, politicians’ private communications, and U.S. law enforcement information.8
Against this vulnerability-riddled backdrop,9 new artificial intelligence (AI) infrastructure is coming onto the grid, introducing new failure points: First, as the series opener argues, the data centers housing AI workloads are becoming valuable targets for nation-states, whose attacks are the focus of this series.10 Second, data centers bring energy vulnerabilities because of their large loads, inflexible profiles, voltage-sensitive controls,11 and facility-level microgrids.12 As data centers connect to a grid where state-linked intruders have already mapped out the cybersecurity landscape,13 the energy-AI infrastructure attack surface grows.14
ARI’s Invisible Backbone Series opener defines AI infrastructure across five layers: model development and software; compute; hardware design and manufacturing; operational and delivery systems; and purpose-built assets, such as data centers’ on-site generation.15 Through this lens, AI is itself an infrastructure sector that depends on the U.S. energy system to power its services. As AI operations proliferate and data center demand climbs into the gigawatts (one gigawatt alone powers upwards of 800,000 households),16 these facilities need reliable and secure energy generation, transmission, and distribution to function. This section follows the energy system from the wellhead to the server rack to examine the nodes that electrons pass through along the way. The paper identifies four existing and one emerging chokepoint, where a single interruption could produce effects that are wide, slow to reverse, and concentrated on AI facilities.
Two data center load features make these facilities particularly susceptible to energy chokepoints: their scale and geographical concentration. A 2025 Idaho National Laboratory (INL) study sets the threshold for a “large load” at 50 megawatts of real power.17 Above that level, in most regions, hourly demand markets alone cannot compensate quickly enough if the load suddenly disconnects (“drops”) from the grid. But hyperscale data center campuses now exceed this threshold, requiring hundreds of megawatts.18 Data centers are also emerging in clusters around the country, in regions such as Texas and the Mid-Atlantic—home to Data Center Alley in Northern Virginia.19 Nearly half of all data center capacity in the United States is concentrated in just five regional clusters, and 50 percent of all new data center construction is sited in pre-existing clusters—resulting in concentrated AI infrastructure chokepoints along the energy network.20 Tracing that network, the first chokepoint is the fuel that powers most data centers.
Natural gas is the largest single source of electricity for U.S. data centers, supplying over 40 percent of their power.21 The International Energy Agency (IEA) projects that gas will constitute the greatest share of new U.S. supply to these facilities through 2030.22 Data center dependence on this energy source is seen both in front of the meter (power drawn from the grid) and behind the meter (generation serving the data center directly), with the IEA projecting that approximately 15–27 gigawatts of on-site natural gas may power U.S. data centers by 2030.23
In a 2025 “Reliability Risk Priorities” report, the North American Electric Reliability Corporation (NERC)—the grid reliability watchdog—finds that pipeline development is not keeping pace with the scale of grid transformation driven by new large loads and energy sources connecting to the grid.24 NERC’s report also warns that the extended lead times for new generation procurement, assembly, and installation are further compounding these constraints.25
Documented physical and cyber attacks on U.S. natural gas and oil networks already reveal the vulnerabilities that attackers can exploit to target the data center clusters. In 2021, threat actors executed a ransomware attack on the corporate IT billing system of the Colonial Pipeline, which delivers roughly 45 percent of the fuel consumed on the U.S. East Coast.26 Colonial had to shut down its 5,500-mile pipeline for six days, causing fuel shortages up and down the coast.27 In addition, according to the Cybersecurity and Infrastructure Security Agency (CISA), U.S. pipeline infrastructure increasingly depends on automation to drive its operations efficiently and reliably.28 CISA warns that pipeline IT and operational technology (OT)—systems that manage physical infrastructure—add new vulnerabilities that attackers could exploit to cause “explosions, equipment destruction, unanticipated shutdowns or sabotage, theft of intellectual property, and downstream impacts to National Critical Functions.”29 In 2020, CISA issued an alert detailing a ransomware attack on the control and communication assets of a natural gas compression facility (a plant that increases natural gas pressure to enable its flow through pipelines), which led the operator to implement a “deliberate” two-day shutdown of its operations, resulting in productivity and revenue losses.30
Actors have also exploited physical entry points along the U.S. pipeline network. In 2016, climate activists temporarily disrupted five pipelines transporting oil from Canada to the United States by closing their manual safety valves.31 In 2017, activists damaged the Dakota Access Pipeline by torching holes through the line and setting fire to its equipment.32 These incidents required minimal resources and little technical sophistication, but nation-state actors could amplify this threat, bringing dedicated resources and the expertise needed to map and exploit such vulnerabilities systematically.
Almost every watt of power a data center draws from the grid must pass through a large power transformer (LPT), which can serve thousands of customers or entire data center campuses.33 The U.S. Department of Energy reports that over 90 percent of all consumed power passes through LPTs, noting that their loss “could disrupt electricity services over a large area of the country,” making LPTs a vital and vulnerable node powering AI infrastructure.34
LPTs are custom-built and have long replacement lead times, making them high-value physical targets for an attacker seeking to cause prolonged disruptions in regions where LPTs serve many data centers. In 2024, CISA’s National Infrastructure Advisory Council (NIAC) found that LPT supply chain constraints are creating wait times of two to four years for transformer replacements.35 Moreover, as the grid’s composition changes, rising transformer demand is spiking prices, making replacements more expensive.36
Attacks on LPTs are not a novelty.37 In 2013, a rifle attack disabled 17 transformers in a substation serving Silicon Valley.38 Surrounding power plants kicked in as operators rerouted power to avoid blackouts. The substation then remained offline for nearly a month.39 Following the attack, NERC implemented a mandatory Physical Security Reliability Standard “to identify and protect” transmission substations from physical attacks.40 But in the last decade, dozens more facilities have been targeted.41 In 2022, another shooting at two substations in North Carolina left tens of thousands of residential and commercial customers without electricity for almost four days and impacted pharmacies, traffic lights, and businesses.42
The Electricity Information Sharing and Analysis Center (the energy sector’s threat-intelligence hub) found that physical security incidents, such as ballistic damage, intrusions, and cut wires, occur every year, impacting grid operations. The Center also determined that, in 2024, 37 percent of grid-impacting incidents were likely sabotage.43 These disruptions demonstrate how attacks on energy chokepoints could bring widespread impacts that cascade through communities.
Control systems are vital for monitoring AI data centers’ energy demand. AI data centers’ unpredictable load behavior challenges the grid’s stability,44 as the loads “can exhibit sharp, short-term ramping behavior that varies by the hour or even minute.”45 Such fluctuations can contribute to cascading failures across the grid, impacting nearby data centers in clustered regions.46
Many data centers also have limited load flexibility, so they cannot automatically adjust their power consumption in response to grid conditions without impacting internal operations.47 INL researchers highlight that data centers require “high, continuous power” and “24/7 availability with minimal tolerance for outages or voltage fluctuations.”48 Even brief outages can cost up to $9,000 per minute of data center downtime.49 Therefore, data center facilities use voltage-sensitive responses, allowing them to quickly detect and respond to grid disturbances.50 In 2024, for example, a failed surge protector on the Eastern Interconnection in Northern Virginia sent 1,500 megawatts of data center loads tumbling off the grid, switching to on-site generation within milliseconds and leaving operators scrambling to respond.51
As these clustered, voltage-sensitive juggernauts come online, operators must navigate a new terrain while maintaining stable power for all energy consumers. Control systems help gather real-time information and allow operators to supervise the grid as data center loads add new strain.52 As large-load fluctuations accompany new data centers onto the grid, operators will likely require more voltage-control equipment throughout the transmission system, increasing their reliance on this technology during sub-minute demand fluctuations.53
According to NERC, the U.S. transmission system is also growing increasingly reliant on telecommunications networks for grid monitoring, remote control, emergency response, and system restoration.54 Because control systems depend on accurate, real-time data to give operators field visibility and enable remote response to disturbances, their reliance on vulnerable networks gives threat actors a path into the grid—the same path Berserk Bear charted when it mapped energy controls from less-guarded peripheral organizations.55
Faced with an aging grid, lengthy infrastructure upgrade timelines, and limited transmission capacity,56 data center developers are building their own microgrids with behind-the-meter generation, on-site storage, and facility-level control systems.57 Data center operators are increasingly moving toward behind-the-meter generation, with 29 percent of surveyed data center executives already deploying on-site generation, another 39 percent planning to add on-site power within the next two years,58 and 70 percent noting that they expect these power buildouts to “significantly” reduce their grid reliance.59 Because these on-site systems run on the same sensors, software, and third-party platforms as grid control systems, they inherit the same vulnerabilities; however, as an increasing share of AI capacity moves behind the meter, the facilities’ system security falls outside utility oversight.
Moreover, attackers could develop mechanisms to disrupt data centers’ power stability from within the facilities themselves. Researchers have demonstrated that “Bit2Watt attacks” would allow threat actors to manipulate semiconductor workloads within a data center to induce power quality distortions that could disrupt internal operations. These attacks can stress data center power-delivery equipment, trigger its protection mechanisms, and, in extreme scenarios, even cause cascading failures across transmission-scale systems.60
Though grid-enhancing technologies (GETs)—hardware and software solutions aimed at optimizing power lines—are not yet widespread in the United States, select utilities are piloting them to extract more capacity from congested power lines, strained by insufficient transmission and distribution infrastructure.61 The grid’s limits are clashing with a wave of power demand from data centers, manufacturing, and electrification, as well as new generation sources.62 Given current bottlenecks, GETs, such as power flow controllers that redirect electricity across the network, shifting it off overloaded lines and onto underutilized corridors, can relieve congestion and increase the capacity of aging infrastructure. As grid pressures intensify, GETs are positioned to become central technologies on the AI-energy frontier, forming the layer of intelligence through which constrained grids can meet new demand. These technologies introduce vulnerabilities of their own, relying on sensors, accurate data, and software to help operators deploy electricity to underutilized power lines.63
As detailed above, natural gas supply, LPTs, control systems, facility-level microgrids, and GETs form the energy backbone of U.S. AI capability; they, and the systems on which they depend, are also the very terrain that groups like Russia’s Berserk Bear, Salt Typhoon, and Volt Typhoon have spent years mapping.64
To demonstrate how the energy-AI infrastructure nexus can be exploited to degrade U.S. AI services, this section takes the perspective of a state-level threat actor. The Invisible Backbone Series defines threat actors as attackers with three attributes: (1) the intent to inflict harm, (2) the ability to identify a sector’s exploitable vulnerabilities, and (3) the capacity to strike selected targets.65 Though non-state actors could carry out similar attacks, this paper limits its scope to state-level threats, as states are the best-resourced and most capable attackers. The scenario below follows a fictional state-linked actor, Lindworm, with the patience to spend years inside U.S. networks and the resources to act across cyber and physical domains.
To achieve lasting effects, Lindworm first identifies targets where damage would have the broadest impact and be difficult to reverse; where capacity is nearly fully utilized, leaving no buffer to absorb shortfalls; and where failure would affect the AI infrastructure that is most critical to the actor’s goals. AI services increasingly underpin U.S. national security operations and government services, so the Lindworm attacker, seeking a military advantage, targets the energy infrastructure chokepoints that power data center clusters supporting classified U.S. defense operations.66
Lindworm first maps the electricity systems powering its AI targets by infiltrating peripheral organizations linked to transmission and distribution system operators, employing the same approach Berserk Bear used. This espionage campaign tells the group which substations feed which data center campuses, which pipelines serve which generators, and where a single transformer carries power for many facilities at once.
With the map in hand, Lindworm attacks the natural gas pipelines and compressors serving major data center hubs, such as Data Center Alley. Because the same pipelines serve many customers, an attack on U.S. natural gas infrastructure could lead operators to deprioritize data center electricity delivery in favor of powering hospitals or households, curtailing the facilities’ grid supply.67 In a prolonged attack, the targeted data centers’ backup fuel reserves could be exhausted, leaving the facilities without on-site redundancy.
Simultaneously, Lindworm targets the LPTs where power losses would be widely felt and slow to repair, attacking the substations that serve concentrated data center loads. The custom-built nature of LPT equipment means transformer spares and interchangeable parts can rarely be quickly substituted.68 LPT replacement lead times already run for up to five years, but Lindworm extends these by striking upstream manufacturers and electrical steel producers.69
The group then corrupts control system data to cause supply-demand imbalances on the grid, leading to instabilities and faults in data center-serving regions. Since data centers tend to be voltage-sensitive, they quickly respond to these grid fluctuations, suddenly and simultaneously dropping large loads off the grid.70 Meanwhile, operators, working from corrupted feeds and delayed by momentary latency, are too late to respond; others respond to events that never happened.71 The grid grows more unstable.
Lindworm then targets the data centers’ microgrids, accessing their controllers to disrupt islanding (the deliberate disconnection from a utility grid) and manipulate automated curtailment signals, sending more loads off the grid.72 Lindworm also attacks the battery energy storage system controls that provide data centers with backup power,73 preventing the on-site batteries from discharging.74 Combined with the generation, transmission, and distribution attacks, the operation strips data centers of their redundancy, curtailing operations. Finally, where GETs are installed, Lindworm targets these by falsifying GET data to push power lines past safe limits, damaging the equipment and interrupting electricity delivery to nearby data centers.75
What makes Lindworm particularly troubling is its sequencing and exploitation of vulnerabilities that concentrated data center loads bring to the U.S. energy system. While the U.S. government has institutional structures for securing energy and IT systems, AI infrastructure remains largely outside the federal purview, limiting security coordination.
In the section above, Lindworm succeeds because it operates in the chasm between two governance regimes, where energy is safeguarded while AI infrastructure is overlooked. This section examines where that chasm lies as a prerequisite for closing it.
Energy is a tightly regulated critical infrastructure (CI) sector, with authorities stemming from statute and executive actions. The U.S. government maintains CI sector security under public-private collaborations,76 where private CI owners and operators assess and mitigate risks to their own assets, while federal agencies evaluate and manage security on a cross-sector and national level.77 The Department of Energy (DOE) serves as the Sector Risk Management Agency (SRMA) for energy, and, by statute, it is responsible for (1) “providing institutional knowledge and specialized expertise” to the sector and (2) securing the sector from an “all hazards environment.”78
The federal government’s energy regulatory oversight and CI coordination authorities stem from separate congressional mandates but are mutually reinforcing. For example, under the Federal Power Act, the Federal Energy Regulatory Commission (FERC) approves, and NERC enforces, Critical Infrastructure Protection standards for energy system owners and operators.79 The Department of Homeland Security’s coordination role also allows for quick responses to security issues. Thanks to existing CI coordination mechanisms and regulatory authority, following the Colonial Pipeline attack, the Transportation Security Administration (TSA) was able to issue the first cybersecurity directives to pipeline operators, requiring them to disclose cybersecurity incidents, appoint a Cybersecurity Coordinator, and submit risk assessment results to CISA and the TSA.80
AI infrastructure, however, sits outside this architecture, addressed only by fragmented efforts originating in the energy sector. AI is not a designated sector, and, until recently, data centers were treated as ordinary customers on the grid’s distribution side. But the status quo is shifting. On July 16, 2026, FERC directed NERC to file mandatory reliability standards and registration criteria for computational loads by the end of the year.81 In addition, DOE’s Office of Cybersecurity, Energy Security, and Emergency Response (CESER) is launching an Artificial Intelligence for Operationally Resilient Technologies and Systems (AI-FORTS) program to expand AI-enabled technologies for energy security.82 Meanwhile, the Cyber Incident Reporting for Critical Infrastructure Act, which aims to give the federal government a cross-sector view of security incidents, has been in rulemaking for over two years without a final rule as of writing.83 This leaves a porous policy landscape that fails to account for the unique vulnerabilities that the energy-AI nexus brings.
The energy-AI infrastructure attack surface is expanding. Threats to the sectors are both kinetic and cyber; key assets are vulnerable to both; and behind-the-meter generation, storage, and control systems are now adding new adversary entry points. Meanwhile, PRC- and Russia-backed operators have already mapped U.S. critical infrastructure networks. Faced with these threats, the United States must identify and mitigate harm across an expanding attack surface that can be used to disrupt not only data centers’ power systems but also interdependent critical infrastructure.
To better secure energy-AI infrastructure against sophisticated state actors, the U.S. government should take the following four steps:
| Designate AI as a Critical Infrastructure Sector Congress and the President have the authority to designate the AI sector as critical infrastructure, opening a sector-wide public-private coordination mechanism with the AI industry, federal agencies, and interdependent CI sectors.84 A CI designation would assign an SRMA to the AI sector, allowing the agency to coordinate with the DOE to identify and mitigate interdependent vulnerabilities in the face of new attacks.85 In addition, the designation would fold AI into the CI ecosystem, subjecting AI infrastructure operators to cyber incident reporting, public-private engagements on national security resilience, federal threat intelligence sharing, and executive intervention to secure essential supply chains.86 |
| Set Security Baselines To ensure AI infrastructure resilience from state-level threats, Congress can grant SRMAs the power to set baseline security standards for particularly vulnerable AI and energy infrastructure entities, such as large power transformers and data center clusters. Under the National Security Memorandum 22 (NSM-22), currently under review,87 the President directed federal agencies with existing regulatory authorities to “establish minimum requirements and effective accountability mechanisms for the security and resilience of critical infrastructure.”88 Congress can go beyond NSM-22 to grant SRMAs the statutory authority to set national security baselines for designated CI sectors, allowing these agencies to enforce security and resilience measures for the CI owners and operators most likely to be targeted by state actors.89 |
| Mandate Periodic Wargaming for AI-Energy Infrastructure Security To anticipate threats early, the DOE, supported by the intelligence community, should coordinate with NERC and the AI SRMA to run tabletop and live exercises (i.e., wargames) that assess the threats that capable actors pose to AI and energy infrastructure security. These exercises would improve cross-sector threat detection and response, produce well-defined security metrics, and establish clear communication protocols across the AI and energy sectors. |
| Set Large-Load Reliability Standards Following FERC’s recent direction, NERC should include standards that safeguard the energy-AI infrastructure nexus from cyber and physical security threats. NERC can also require that any control systems and GETs that utilities and data center operators deploy onto grids serving data center clusters be secure by design. |
U.S. AI capabilities rest on an energy system that state actors have already spent over a decade navigating. That system was aging before AI juggernauts’ demand arrived at gigawatt scale. The demand is here, and data centers are introducing a new class of vulnerabilities. The fastest-growing loads in the country now sit at the end of chokepoints that adversaries already understand. Berserk Bear mapped energy systems to learn which switch to flip. Volt Typhoon pre-positioned software for activation in future conflicts. As the grid is being transformed by new energy demand, generation, and technology, the U.S. government has an obligation to ensure that these systems incorporate safety standards that are tailored to the threats that AI infrastructure concentrates and exacerbates.
AI has increasingly become an underlying infrastructure for the United States, yet the AI sector lacks formal recognition as critical infrastructure, leaving it without public-private coordination mechanisms, information sharing, asset mapping, and protection standards commensurate with AI’s increasing role in critical operations.
ARI’s blueprint for federal AI governance is designed to promote safe frontier AI development in America. The blueprint is built around three governance functions any federal proposal should incorporate.
PDF
Load growth from computational demand is outpacing the ability of grid planners, energy analysts, and policymakers to track, model, and manage its consequences.
