By 2028, Misconfigured AI Could Shut Down Critical Infrastructure in a G20 Nation: Gartner

Gartner has warned that by 2028, a misconfigured artificial intelligence system in cyber-physical infrastructure could trigger the shutdown of national critical infrastructure in a G20 country.

The research firm said the next major infrastructure failure may stem not from cyberattacks or natural disasters, but from flawed AI configurations embedded within complex control systems.

Gartner defines cyber-physical systems (CPS) as engineered systems that combine sensing, computation, networking and analytics to interact with the physical world. These include operational technology (OT), industrial control systems (ICS), industrial automation, industrial Internet of Things (IIoT), robotics, drones and Industry 4.0 platforms.

According to Wam Voster, Vice President Analyst at Gartner, the growing reliance on AI to manage real-time industrial and national infrastructure systems introduces new systemic risks. “The next great infrastructure failure may not be caused by hackers or natural disasters but by a well-intentioned engineer, a flawed update script, or a misplaced decimal,” he said.

Modern AI models embedded in power grids, manufacturing plants and transportation networks often function as opaque “black boxes,” making it difficult to predict how minor configuration changes could alter system behavior. A misconfigured predictive model in a power grid, for example, could misinterpret normal demand fluctuations as instability, potentially triggering unnecessary load shedding or isolating entire regions.

Such failures could result in physical damage, service outages and significant economic disruption, directly affecting public safety and national stability.

To reduce these risks, Gartner recommends that chief information security officers implement strict governance and technical safeguards around AI in CPS environments. The firm advises deploying secure override mechanisms or “kill switches” that allow authorized operators to intervene in fully autonomous systems.

It also recommends building full-scale digital twins of critical infrastructure systems to test updates and configuration changes before live deployment. Real-time monitoring, rollback capabilities and the creation of national AI incident response teams are further measures Gartner says are essential.

The forecast underscores a broader shift in cybersecurity thinking: as AI becomes embedded in physical infrastructure, misconfiguration risk — not just malicious intrusion — is emerging as a potential national security threat.