Connecticut’s Attorney General William Tong and Consumer Counsel Claire Coleman have petitioned the Public Utilities Regulatory Authority (PURA) to review AI use by the state’s public utility providers.
“Artificial intelligence adoption is rapidly outpacing our ability to understand and control for risk,” said Tong. “It’s not a question of whether our utilities are using AI—we know they are. We need to know exactly where, why and how it is being deployed, and what safeguards are in place to ensure the security and stability of our critical energy systems and infrastructure.”
The joint petition, which was filed this morning, said it is “critical” that PURA work with state and utility providers to “review and establish best practices for AI and data security.” Tong and Coleman recommended that PURA officials evaluate public utilities’ use of AI for storm response, customer systems, asset management, consumer demand forecasting, procurement of equipment, grid, power plant and water systems operations and maintenance, third-party vendors, and automated metering systems.
“In addition to the inquiry of these topic areas, each of the companies should be required to report all use of AI systems in their operations including but not limited to the functional objective of the system, the level of human oversight, and the policies, procedures, and protocols that govern the use of AI systems within their organizations,” reads the petition.
The petition links two statements, one by Avangrid and the other by Eversource, in which the companies confirmed using AI, noting that “the extent and scope” of the providers’ AI usage is unclear. Tong and Coleman said the technology’s previous track record of providing users with inaccurate information raises cause for concern, and cited a handful of examples in which AI’s use in forecasting natural disaster impact has come up short.
“Taking storm response as one example, a conventional weather model outperformed AI models in accurately predicting a Nor’easter that hit the northeast this past February,” reads the petition. “Another example of AI predictions gone awry took place in California, where wildfires were ten times bigger than the utility’s AI forecast.”
Tong and Coleman also requested PURA evaluate how utility providers are protecting infrastructure from cyberattacks and data breaches, “both stemming from AI and outside of AI.” They said such an inquiry “should include” which agencies and customers are informed of data breaches, whether providers have followed state law for reporting such breaches, and whether providers actually review their policies and practices in the aftermath of breaches.
“With respect to cybersecurity and data privacy, AI can be used both as a sword and a shield, to hack into systems as well as to help energy companies identify and patch vulnerabilities,” reads the petition. “While there are a variety of training systems and security frameworks available, the steps Connecticut utilities are taking to ensure systems are protected in the face of AI proliferation has not yet been comprehensively examined by the Authority.”
The petition comes as the national conversation surrounding AI continues to grow. On August 19, several federal agencies released a joint advisory warning that advanced AI models have made hacking into utility infrastructure significantly easier. Open-source AI available to the public, such as ChatGPT or Claude, has allowed hackers to quickly write code targeting programmable logic controllers (PLCs), computers commonly used to automate the functions of factories, power plants, and water treatment centers.
“This is not a theoretical risk—it is an active threat,” reads the statement. “Depending on the specific circumstances, exploitation of poorly protected PLCs [computers that automate utility functions] could lead to disruption of critical industrial processes, safety incidents, downtime or equipment damage, compromise of sensitive data, compliance violations, and cascading impacts across interconnected systems.”
In September, Anthropic, Claude’s parent company, released a risk assessment report revealing various ways in which human actors have used the rapidly advancing technology for wrongdoing. The report found that Houthi insurgents in Yemen used Claude to program advanced missile technology, Russian officials attempted to use it to coordinate a cyber espionage campaign against Ukraine, Chinese officials attempted to use it to surveil ethnic minorities, and various users attempted to use Claude for the creation of novel bioweapons. Other recent occurrences, most notably the OpenAI-Hugging Face incident, have also increased concern that autonomous AI can pose a threat entirely on its own, without need for human intent or interaction.
“As the use of AI increases, regulatory oversight of its implementation with respect to essential, every day utility services cannot fall behind,” said Coleman. “That’s why we’re calling for this review to better understand how these tools are being used, identify potential risks, ensure sensitive customer information is secure and innovations serve the interests of consumers rather than exposing them to unnecessary harm.”
