An Anthropic lead expects AI bug-finding to flood small plant operators with patches

Sergiy Konovalov, Global Technology Partner Lead at Anthropic, argued that AI-driven bug finding is good news with a catch. On Black Hat's panel on AI and the future of cyber defense, he said industrial vendors are finding many flaws. He expected a flood of patches to reach operators who have probably not prepared.

What was said

Konovalov said the industrial automation community is actively embracing frontier models, the newest and most capable AI systems. He said vendors are finding quite a lot of vulnerabilities, which he called a good thing. But he saw a "tsunami of patches" coming to operators. In his view they have probably not prepared, especially in operational technology, the control systems that run physical plants.

Earlier, a speaker on the show explained why critical infrastructure struggles with patches. The teams are very small and manage a large base of assets. Patches wait for a maintenance window, which can be months and sometimes years away. As transcribed, the speaker put the share of unsupported assets across critical infrastructure at 30 to 60 percent, and said some parts cannot be patched. The moderator added that water facilities in several states had reported intrusions, and some Minnesota plants had gone manual.

Konovalov also spoke about visibility. He put the industry average at "about like two out of ten operators" who firmly understand the assets they run.

Why it matters

Our reading: finding flaws is not the same as protecting plants. Vendors using frontier models are, in Konovalov's words, finding quite a lot of vulnerabilities. The plant that runs the device still needs a maintenance window, a person with time and a list of what it owns.

For anyone who buys or runs industrial software, the work of applying patches does not fall on the finder. On this account, it falls on the smallest team at the end of the chain. Buyers could ask vendors what a patch costs a plant to apply, not just how many flaws were fixed.

The other side

Konovalov was optimistic. He said AI can help small utilities finally understand their assets. He described Claude reading a captured network recording from an industrial system and explaining how it works. He expected virtual patching, which protects a device without changing it, to get faster. He also said a small utility does not need yet another tool.

Another panelist, Morgan Adamski of PwC, said AI-discovered flaws may not all end up with a patch. That sharpens the problem for equipment that cannot be updated. In the passages quoted here, Konovalov gave no figure for what the patch flood will cost operators, or who will pay for extra staff or maintenance windows.