Utility AI Weekly — October 9, 2026

By Marc RossonUtility AI Digest


This week: Anthropic made two critical-infrastructure moves in three days. On Tuesday its restructured Cyber Verification Program named municipal utilities as eligible for reduced cyber safeguards, by right rather than by invitation. On Thursday its new Cyber Mission began delivering frontier models to utilities through the OT-security vendors they already buy from, including Dragos, Nozomi Networks and Rockwell Automation. Google named three power-sector customers in one post: one with agents deployed, one deploying, one planning. The planned one is Constellation, whose five-year Gemini alliance rode alongside an 890 MW nuclear-uprate deal and puts bulk-electric-system OT networks in scope. At SAP Connect, SAP turned autonomy into a per-agent setting with a three-mode oversight model, though little of it is generally available yet.

The week’s other through-line is the one this digest keeps returning to: every artifact is silent on NERC CIP. That includes a frontier lab, a hyperscaler, the ERP vendor and the power-engineering profession’s own flagship magazine. Where the documents describe agent authority at all, they describe it at the platform level, not at the boundary of a control room.

🤖 Control-Room & Operational AI

The operational thread got a deployed utility-side claim this week, and it isn’t in the control room. Google’s Gemini at Work 2026 (October 8) names three power-sector customers at three different stages. Keeping them apart is the point.

  • Deployed: Hitachi. Through HMAX, Hitachi is deploying agents directly to power-and-utilities field technicians, who have built agents for 200+ use cases. The worked example is image-recognition agents that verify photos of every tool and wire before and after a job. Hitachi reports productivity up to 30%. This is vendor-reported and is field operations, not dispatch.
  • Deploying, results expected: Santee Cooper. South Carolina’s state-owned electric and water utility is deploying a Gemini Enterprise model for financial scenario modeling and natural-language queries. It expects modeling up to 75% faster across a $10 billion grid-expansion budget. That figure is a forecast, and the use case is capital planning.
  • Planned: Constellation. Constellation “will build” Gemini Enterprise agentic workflows into core operations under a five-year alliance announced October 6. The focus areas are speed to power (power-flow modeling, interconnection planning), generation optimization (outage and turnaround management, asset health) and protecting critical infrastructure. The release says securing OT networks that are often air-gapped and connect to the bulk electric system is in scope. It is the first hyperscaler–utility AI agreement in this digest to say that. There is no NERC CIP mapping and no human-oversight statement, and every capability is in the future tense.

The pattern from Bidgely (September 22) holds. Utilities are granting agents authority at the edges, in the call centre and in field-crew job verification, well before dispatch.

The tracked incumbents were silent for a sixth consecutive week. OATI’s newsroom is unchanged since September 17, and MCG Energy Solutions has produced no AI material in this log’s lifetime. The standing anchor is unchanged: OATI’s AI Genie at CAISO remains the only confirmed production agentic deployment in US grid operations this digest tracks. It triages 500-plus next-day outage requests in under eight minutes, and operators keep final authority.

The week’s largest vendor event is about data, not agents. Schneider Electric agreed to acquire PTC (October 5): $205/share in cash, about $22.6B equity value and $23.7B enterprise value, at a 42.3% premium. The pitch is a “contextualized AI Data Foundation across products & machines and processes & energy systems.” It adds Creo, Windchill and Onshape to Schneider’s AVEVA estate, and to the pending Cognite acquisition if that clears regulators. The deal closes Q3 2027. It has no agentic capability, no named utility and no grid software. The consequence a utility should note now is vendor concentration: design, PLM, industrial operations and industrial data could end up under one owner, and with it the asset data any AI layer will query.

🏭 In Production vs. 🔮 Forecast / Marketing

🏭 In production, available now, or shipping

  • Anthropic Cyber Verification Program, three tiers (October 6). This is available now. Defense Access is open to “operators of critical infrastructure of any size, such as regional hospitals or municipal utilities,” with applications answered within days. It is an access program, not a security program, and it comes with a data-retention condition (below).
  • Anthropic Critical Infrastructure Defense Program (October 8). This is live as a partner arrangement with “a small cohort of providers.” There are no disclosed results and no named utility.
  • Hitachi HMAX field agents (October 8). Deployed, per Hitachi and Google: 200+ use cases, up to 30% productivity.

🔮 Forecast, roadmap, and marketing

  • Santee Cooper’s 75%. An expected figure, not a measured one.
  • Constellation × Google Cloud. “Will build.” Everything is planned, and nothing is stated as live.
  • SAP Connect (October 6–7). SAP declared the autonomous enterprise operational. In fact only SAP Pay and a few integrations ship in October. Supply-chain agents and the Trade and Governance Assistants are slated for Q4 2026, CX and Spend Analytics for Q1 2027, and several finance assistants for Q1 2027 under Early Adopter Care only. The 110,000 internal users and “20% productivity gains” are SAP measuring SAP.
  • Google’s agent-governance features (October 8). Attested identity, Agent Sandbox and Agent Gateway are platform claims. The post gives no availability status and ties them to no utility deployment.
  • Schneider–PTC. The deal closes Q3 2027, and its AI claim is a data-foundation claim.
  • Onapsis Agentic Gateway / MCP Gateway. Still a preview since March 17, now in its twelfth month: no GA, no named customer, scope unstated.

🛡️ AI & Grid Cybersecurity

A frontier lab conceded the OT patching constraint in its own words. The Anthropic Cyber Mission (October 8) targets the OT behind power grids, water systems and transportation networks. Its premise is the timing argument OT vendors have been making: OT “often cannot be taken offline to patch, so known vulnerabilities can stay unresolved for years,” and some fixes may wait decades. The summary line is worth quoting in any procurement file: “Critical infrastructure is hard to defend in many ways that AI cannot fix.” Anthropic expects the near term “may not” favour defenders, and that AI will favour defence in two years.

Vendor-run survey data put a size on the gap. Palo Alto Networks’ 2026 State of Critical Infrastructure Cybersecurity Report (October 6) surveyed 1,600+ security leaders in 11 countries:
– 95% are concerned about frontier-AI-powered attacks.
– 29% of CVEs were exploited within 24 hours, against a 55-day average to deploy a patch.
– 68% lack complete real-time visibility of OT-connected assets.
– 74% have not fully integrated IT and OT security operations.
– 42% name legacy, unpatchable OT as their biggest risk.
– 60% had a significant breach in the past year, and half of those cited physical-safety concerns.

Read it with the discounts. The vendor ran the survey with no named research firm, there is no energy breakout, and Palo Alto Networks is one of Anthropic’s eleven CIDP founding partners.

The profession answers from its own flagship venue. IEEE Power & Energy Magazine’s September/October special issue, On High Alert: Securing the Grid, was edited by Manimaran Govindarasu (Iowa State) and Brian Johnson (University of Idaho) and announced October 5. It argues for AI-enabled grid security operations centres that “embed cybersecurity directly within power system operations,” with “human-governed decision support.” Its table of contents is an agenda for this digest’s open questions: “Cybersecurity of the control room of the future,” “Guarding digital substations” and “Beyond the checklist: Modernizing cybersecurity regulation for the U.S. power grid.” That last title concedes the point drawn from NERC’s own CIP Roadmap, which ranks AI 21st of 22 risks. The press summary carries no data, and “agentic frameworks” are named without detail. The two articles that bear most directly on this digest are flagged for a full read.

The SAP estate a utility is migrating to has three documented pivot paths. The Onapsis blog moved for the first time in twelve checks on October 9, with Beyond the Perimeter, written by CTO JP Perez-Etchegoyen and offensive lead Pablo Artuso:
1. Cloud Connector trace logs expose Base64-encoded credentials, which lead to an on-premises escalation that reaches SAP_ALL.
2. Leftover BTP communication arrangements let an attacker provision unmonitored backdoor users in BTP.
3. A low-criticality Cloud Foundry app leaks VCAP_SERVICES credentials that reach an HR system across subaccounts.

The post’s headlines are “Firewalls No Longer Protect SAP Data” and “Subaccounts Are Not Hard Security Boundaries.” The post has no AI content. The inference for utilities is direct, though: these are the paths a RISE-migrated utility’s ERP agents will call through. The recommended fix, principal propagation, closes the stored-credential path. It also means every agent action carries a human’s full authorizations.

🏛️ AI-Provider Posture Toward Critical Infrastructure

Anthropic built out both halves of a critical-infrastructure posture in one week.

  • Access (October 6). Project Glasswing merged into a three-tier Cyber Verification Program:
  • Defense is size-independent, and municipal utilities are named.
  • Red Team is for organizations only. It keeps real-time blocks on “deploying ransomware, damaging physical systems.”
  • Specialized has the fewest blocks. It is for organizations authorized to test safety systems, with power grids named, and each is reviewed “in collaboration with the US government.”

Anthropic also published the number this thread had never had. On CyScenarioBench, Red Team Access completed 34 of 50 tasks with no blocks, which Anthropic says matches the model’s 67.6% success rate with no safeguards. That is unusual transparency. It also shows that the gap between a vetted red team and an unrestricted capability is a verification step. Two conditions gate a CIP-regulated utility. First, data retention is required for misuse monitoring until Enterprise Frontier Safeguards ships “later this fall.” Second, on Amazon Bedrock the program is available only to customers eligible for Enterprise Frontier Safeguards.
– Delivery (October 8). The Critical Infrastructure Defense Program brings models, on-site engineers and threat research to Accenture, Booz Allen, CrowdStrike, Deloitte, Dragos, Hitachi, Insane Cyber, Nozomi Networks, Palo Alto Networks, PwC and Rockwell Automation. It is the third delivery model in this digest, after OpenAI’s Daybreak (a $1B subsidy, direct to large IOUs) and the CVP (apply and attest). This one reaches the substation through the vendor already contracted to monitor it. The question it creates goes unaddressed: frontier-model assistance inside a vendor’s OT engagement extends that vendor’s CIP-004/011/013 footprint, and the utility will have to evidence it.

Google published the most complete agent-governance list a hyperscaler has offered here.
– Each agent gets a cryptographically attested identity with least privilege, under permissions approved by a security administrator.
– Every action goes to an audit trail attributed to the agent, not a person.
– Each agent runs in its own Agent Sandbox.
– An Agent Gateway acts as an AI network firewall enforcing policy on all agent traffic.
– Spend caps pause the agent when triggered.

This is the CISA five-nation sheet’s “cryptographically anchored credentials” requirement in product form. It is also the opposite of what SAP runs in production today (below). It is untested against a utility.

SAP gave autonomy a dial at SAP Connect, but no enforcement point yet.
– October 6: “customers set how much autonomy each assistant has,” with an ISO/IEC 42001-certified governance architecture.
– October 7, keynote recap: a three-mode oversight model, “human-in-the-loop approval, human-on-the-loop monitoring, and human-in-command override authority,” under the rule “the more autonomously an agent operates, the tighter the oversight applied.” The recap adds the requirement that “every agent should have a verified owner, a risk tier, and scoped access rights.”

This is the first time oversight has been expressed as a function of autonomy in the ERP thread. Three deductions apply:
1. The 42001 claim is not repeated in the keynote recap.
2. Assistants run within “a company’s existing data, authorizations, and audit trails,” which means inherited human authorization.
3. The policy enforcement point between an agent and its tools or MCP is dated “H2/2026” in SAP’s own Agent Identity reference architecture.

So agent identity exists on paper, and inherited authorization is what runs in production.

🔍 Vendor Watch

OATI: no new material, sixth consecutive week; newsroom unchanged since September 17. Standing position: AI Genie in daily production at CAISO.

MCG Energy Solutions: silent on AI, sixth consecutive week.

Onapsis: the static streak ended at eleven checks. The October 9 blog post on hybrid pivot paths (above) is the first new research item since the September 18 SAPMAP advisory. The October 8 press release is an industry award, which is marketing. Agentic Gateway / MCP Gateway: preview since March 17, twelfth month, no GA, no named customer, inbound/outbound scope unstated, and not mentioned in the new post. SAPMAP: no follow-on in twenty-one days. SAP’s October patch day is October 13, the next datable chance for Onapsis Research Labs content.

SAP: the vendor that moved most, on language more than on shipping. Autonomy is now a per-assistant setting with a three-mode oversight model. AI Agent Hub is described as an operating inventory inside LeanIX. Its reference architecture (RA0034) is unchanged since October 1: it has no availability statement, describes the Agent Gateway as “the runtime enforcement point” without a GA date, and lists an AI governance assistant and local agent discovery “including Claude Code” as in preview. It never uses the term “Verification Seal.” Named early SAP Connect customers include Novartis, Nestlé, PwC and Maschinenfabrik Reinhausen. No utility, for a twelfth consecutive item.

Anthropic: two critical-infrastructure moves in three days (above). No named utility participant in either.

Google: one deployed power-sector agent claim (Hitachi), one forecast (Santee Cooper), one plan (Constellation), plus the platform governance list.

Schneider Electric: the PTC acquisition (above). Through AVEVA it also owns OSIsoft, the data-historian layer that research prototypes in this log, such as Georgia Tech’s GridLogic, depend on.

Hitachi: on both sides this week. It deployed field agents via HMAX and is a founding partner of Anthropic’s CIDP.

GE Vernova, Siemens (grid software), Itron, Bidgely: nothing in-window.

⚡ Utility-Sector Relevance Flags

  1. A municipal utility can now enter a frontier-lab cyber program unaided. If you are a public power utility or co-op, Anthropic’s Defense Access tier is the first one written for you. Before applying, settle the data-retention question against your BCSI handling, because zero data retention isn’t available on most models until Enterprise Frontier Safeguards ships. If you run on AWS, check Bedrock eligibility.

  2. Your OT-security vendor may soon be bringing a frontier model into your environment. Dragos, Nozomi Networks, Rockwell Automation and Hitachi are founding CIDP partners. Ask your vendor now whether model-assisted work touches BES Cyber System Information, and how that is reflected in its CIP-004, CIP-011 and CIP-013 evidence. Ask before the first engagement report arrives, not after.

  3. The safeguard number cuts both ways. Red Team Access matches the model’s no-safeguards success rate (67.6%). The verification step, not the tier, is where the risk sits. Treat any frontier-model access grant as a privileged-access decision with an owner and a review date.

  4. Separate deployed, deploying and planned in every vendor deck. This week’s Google post did it for you: Hitachi deployed, Santee Cooper expects, Constellation will build. Hold every AI proposal to the same three labels, and don’t let an expected percentage stand in for a measured one.

  5. BES-connected OT is now named in a hyperscaler AI agreement. Constellation’s alliance puts securing OT networks that connect to the bulk electric system in scope, and it has no CIP mapping. If a cloud-AI contract mentions OT, the CIP boundary analysis belongs in the contract review, not in a later implementation phase.

  6. Use Google’s governance list as a requirements checklist, whoever your vendor is. It covers attested per-agent identity, an audit trail attributed to the agent, a per-agent sandbox, a gateway enforcing policy on agent traffic, and a hard pause. It is the most complete specification any vendor has published here. Ask every agent vendor which items they have, today.

  7. An ERP agent acting as a person is acting with that person’s full authorizations. SAP’s production model is inherited authorization, and its enforcement point is dated H2/2026. Onapsis’s recommended hardening, principal propagation, entrenches the same model. Scope ERP agent pilots to accounts with minimal authorizations, and track SAP’s enforcement-point release.

  8. Audit your RISE plumbing before agents start using it. Look at Cloud Connector tracing, leftover BTP communication arrangements, and shared destination services across subaccounts. These are this week’s documented pivot paths, and they are the routes BTP-hosted agents will use to reach on-premises data.

  9. Vendor consolidation is coming to the industrial data layer. Schneider + AVEVA (OSIsoft) + PTC, plus Cognite if it clears regulators. Before your next historian or asset-data renewal, write down how portable that data is. Any AI layer you buy later will be querying it.

  10. Read the profession’s own case, then ask for the data. IEEE PES’s special issue argues for AI-enabled grid SOCs with human-governed decision support, and for regulation “beyond the checklist.” It is the right agenda from the right venue, so far without figures. The control-room and regulation articles are worth circulating to your CIP and operations leads.

  11. Still nobody maps to NERC CIP. Every in-window artifact is silent on it and on where agent authority stops at the ADMS/SCADA/OMS boundary: Anthropic twice, Google, Constellation, SAP, Onapsis, Palo Alto Networks and IEEE PES. That mapping remains the registered entity’s own work.

  12. The New York inventory clock: about five weeks to November 16. This week added a new category for that inventory: agents arriving through a security vendor’s engagement, not through your own procurement.

📚 Sources

Primary (in-window, October 5 – October 9, 2026):

  • Anthropic — Cyber Verification Program (October 6; merges Project Glasswing; three access tiers; CyScenarioBench evaluation) · https://www.anthropic.com/news/cyber-verification-program
  • Anthropic — Introducing the Anthropic Cyber Mission (October 8; Critical Infrastructure Defense Program and OSS Scanner) · https://www.anthropic.com/news/anthropic-cyber-mission
  • Google Cloud — Gemini at Work 2026: Introducing Gemini agent (October 8; Hitachi HMAX, Santee Cooper, Constellation; agent-governance features) · https://cloud.google.com/blog/products/ai-machine-learning/welcome-to-gemini-at-work-2026
  • Constellation Energy — Google and Constellation Announce Landmark Agreement to Bring 890 MW of New Nuclear Capacity to PJM Grid as Part of Long-Term Power Deal (October 6) · https://constellationenergy.com/news/2026/10/google-and-constellation-announce-landmark-agreement-to-bring-890-mw-of-new-nuclear-capacity-to-pjm-grid.html
  • SAP News Center — SAP Puts the Autonomous Enterprise to Work (October 6, SAP Connect) · https://news.sap.com/2026/10/sap-connect-sap-puts-autonomous-enterprise-to-work/
  • SAP News Center — SAP Showcases the Autonomous Enterprise in Action (October 7, keynote recap) · https://news.sap.com/2026/10/sap-connect-keynote-autonomous-enterprise-in-action/
  • PTC newsroom — Schneider Electric to Acquire PTC (October 5) · https://www.ptc.com/en/news/2026/schneider-electric-to-acquire-ptc
  • Palo Alto Networks — State of Global Critical Infrastructure Cybersecurity 2026: 95% of Leaders Concerned About Frontier AI-Powered Attacks (Rich Campagna; October 6) · https://www.paloaltonetworks.com/blog/network-security/state-of-global-critical-infrastructure-cybersecurity-2026-95-of-leaders-concerned-about-frontier-ai-powered-attacks/
  • Iowa State University News Service — Special Report: Researchers Say AI Can Help Protect the Grid From AI-Driven Attacks (October 5; on IEEE Power & Energy Magazine, September/October 2026, On High Alert: Securing the Grid) · https://www.news.iastate.edu/news/special-report-researchers-say-ai-can-help-protect-grid-ai-driven-attacks
  • Onapsis blog — Beyond the Perimeter: How Attackers Pivot Across SAP Cloud Migrations (and How to Stop Them) (JP Perez-Etchegoyen and Pablo Artuso; October 9) · https://onapsis.com/blog/securing-sap-cloud-migrations-attack-surface/

Secondary (in-window reporting used to source the above):

  • SiliconANGLE — Anthropic folds Project Glasswing into an expanded three-tier Cyber Verification Program (October 6) · https://siliconangle.com/2026/10/06/anthropic-folds-project-glasswing-into-an-expanded-three-tier-cyber-verification-program/
  • CyberScoop — Anthropic rolls out program for ‘long-term commitment’ to secure critical infrastructure, open source software (October 8) · https://cyberscoop.com/anthropic-cybersecurity-program-critical-infrastructure-open-source
  • The Register — AI company moves to defend critical infrastructure and open-source projects from AI (October 9) · https://www.theregister.com/ai-and-ml/2026/10/09/ai-company-moves-to-defend-critical-infrastructure-and-open-source-projects-from-ai/5302128
  • SAPinsider — At SAP Connect, SAP Expands Joule Across Every Line of Business (availability schedule) · https://sapinsider.org/blogs/at-sap-connect-sap-expands-joule-across-every-line-of-business
  • Constellation Research — analyst read on SAP Connect availability · https://www.constellationr.com/insights/news/sap-highlights-its-autonomous-enterprise-joule-agent-vision
  • Schneider Electric — acquisition release with strategic rationale and synergy figures (October 5) · https://www.se.com/ww/en/assets/pdf/Schneider-Electric-to-acquire-PTC
  • EurekAlert! — IEEE PES special-issue release (October 5) · https://www.eurekalert.org/news-releases/1146567

Watch-item reads (fetched in-window, not counted as items):

  • SAP Architecture Center — SAP AI Agent Hub (RA0034; last updated October 1, 2026; re-read October 5–10, unchanged) · https://architecture.learning.sap.com/docs/ref-arch/jkg4j2
  • SAP Architecture Center — Agent Identity (140bdb; enforcement point “will be released in H2/2026”) · https://architecture.learning.sap.com/docs/ref-arch/140bdb
  • Onapsis press page (newest item October 8, an industry award; marketing, not counted) · https://onapsis.com/company/news-press/press/

Out-of-window, named for context and not counted:

  • NERC — Critical Infrastructure Protection Roadmap (January 2026; AI ranked 21st of 22 risks) · https://www.nerc.com/globalassets/our-work/reports/special-reports/nerc_cip_roadmap_01122026.pdf
  • CISA and partners — Careful Adoption of Agentic AI Services (April 30, 2026) · https://www.cisa.gov/resources-tools/resources/careful-adoption-agentic-ai-services
  • Microsoft — 2026 Digital Defense Report (October 1, 2026) · https://www.microsoft.com/en-us/security/security-insider/threat-landscape/2026-digital-defense-report
  • AWS — Agentic Grid Planning with Duke Energy (September 17, 2026) · https://press.aboutamazon.com/aws/2026/9/aws-launches-agentic-grid-planning-program-to-accelerate-interconnection-studies
  • IEA — Modernising Grids in the Age of Electricity (September 21, 2026) · https://www.iea.org/reports/modernising-grids-in-the-age-of-electricity
  • National Academies — Integration of Artificial Intelligence in the Electricity System workshop (October 26–27, 2026; announced earlier) · https://www.nationalacademies.org/projects/CAST-PSSI-26-01/event/47015
  • Georgia Tech — GridLogic (August 24, 2026) · https://ece.gatech.edu/news/2026/08/ai-tool-aims-help-grid-operators-respond-faster-threats-and-outages

Method: assembled from UtilityAI_Research_Log.md entries for October 5, 6, 7, 8 and 9, 2026, under a strict Monday–Friday window (October 5–9). The October 9 daily entry was written late, on October 10, because the scheduled run did not fire while the host machine was asleep. This digest was also built on October 10 for the same reason. Ten in-window primary items. The October 5 entry contributed none in-window: AWS/Duke (September 17), the NERC CIP Roadmap (January), the CISA agentic sheet (April 30) and RA0034 (October 1) all predate Monday, so they are held as context. Also held: McCrary/Booz Allen (September 28), Kiasari & Aly (January), SAP’s d2e34e architecture (June 18), the IEA report (September 21), Microsoft’s MDDR (October 1), Dong et al. (June 24), the National Academies workshop announcement, and GridLogic (August 24). No duplicates against the October 2 issue’s Sources. The 📜 Regulatory, Standards & Policy section is omitted: no binding regulatory or standards action was published in-window; the IEEE “Beyond the checklist” article is noted under cybersecurity. Supplementary searches for OATI/MCG movement and ISO/RTO deployments found nothing in-window. PJM’s GridAdvance Summit (October 15) was already covered in the daily log and falls next week. Opening layout follows the DER weekly’s SEO convention (seo comments plus a “This week” lead, method note at the end); the post title is unchanged from prior issues.