A group of researchers has trained an AI to automatically defend industrial control systems against hackers, without waiting for a human to react.
The work models the problem of stopping an attack on Operational Technology (OT) - the software and hardware that run things like power grids, factories, and water treatment plants - as a decision problem where the defender can't see everything happening on the network. The researchers used only network traffic measurements to approximate what the AI can actually observe, then trained it with a reinforcement-learning method called PPO (Proximal Policy Optimization) to pick response actions on the fly. They tested the resulting system on an emulated OT network against a set of attack techniques drawn from MITRE's ATT&CK framework, a widely used catalog of real-world hacking tactics. The AI's responses held up against several of those attack types in the simulated environment.
That partial-observability piece is the interesting bit. Most industrial security tools assume you can see the whole network clearly, which is rarely true in practice - OT environments are full of legacy gear and blind spots. Building a system that has to make good decisions with incomplete information is a much closer match to how OT security actually works, and it is a problem space that has had far less research attention than intrusion detection.
Still, this ran in an emulator, not on an actual power plant. Handing an AI the authority to autonomously respond to what it thinks is an attack on physical infrastructure is a different risk calculus than flagging a suspicious login. The paper shows the idea works in a lab. Whether anyone lets it near a live grid is a separate question entirely.