An AI agent ran a power grid. Opening a breaker is the normal control action, which is the whole problem.

August 11, 2026 · by Kate Sai Kishore

In December 2015, attackers took down power to about 230,000 people in western Ukraine. They did not break the grid’s protection. They logged into the control system and opened breakers, one substation at a time, using the same interface the operators used.

Nothing malfunctioned. Every relay behaved exactly as designed. Opening a breaker is not a fault — it is what a control room does all day, for maintenance, for switching, for reconfiguration. There is no current signature that separates maintenance from sabotage, because the difference is not in the electricity.

So we gave a transmission network to an AI agent, put a check in front of it, and then measured what happens without one.

A real network, and its real protection

The grid is the IEEE 14-bus network as shipped in grid2op, the open-source power-system environment used for the L2RPN competitions: 14 substations, 20 circuits, 6 generators, 11 loads. It computes the AC power flow, and it runs the network’s own protection — when a conductor exceeds its thermal rating, the relay opens it.

That last part is what makes this worth doing. The cascade is not scripted. It is what the physics does when flow redistributes.

The agent reads every instrument and issues switching and redispatch commands through a control interface. When a command is allowed, a breaker really opens and the power flow is really recomputed.

What a relay can and cannot ask

Protection relays are excellent at their job, and their job is one question, asked thousands of times a second: is this conductor about to be damaged?

They cannot ask the other one: did whoever sent this command have any reason to believe what they said? A relay sees current. The command that opened the breaker is not in the current.

And there is a second twist that makes a grid different from a tank or a reactor. When one circuit goes, its flow lands on its neighbours. If that pushes a neighbour past its rating, that relay opens too — correctly — and its flow lands on the next one.

Four questions, before the breaker moves

In front of the agent we put a gate — not something watching and scoring afterwards, something in the path. Every command is checked before it reaches the network, and the check asks four things:

Is it true? Is it current? Is it allowed? Is it enough?

In practice: are the loadings and currents it cites the ones the instruments actually reported? Do the instruments agree with each other — does the claimed loading match the measured current, does generation exceed demand by a plausible transmission loss? Is there an approved, current, written switching procedure that permits this, on this circuit, at this moment? Is this operator cleared for that part of the network? And is the network in a state where no automatic action is appropriate at all, so the right answer is a human?

Twenty-seven commands were put through it, and every one landed at the stage that had been predicted for it in advance. That last detail is the one that makes a number mean anything: a command refused for a reason nobody expected is not a pass, it is a coincidence.

Then we took the check out of the path

The measurement that matters is not what the gate stops. It is what a network looks like without one — the relays, the conductors, and nothing in between.

So every one of the same commands was issued straight to the grid.

One command took a circuit out at a moment when the network was already running at 93 percent on its worst conductor. The flow landed on a neighbour, which went to 128 percent of its thermal rating — and a conductor at 128 percent is a relay about to open, which is where a cascade starts. Another command opened the single circuit feeding a generator’s substation, stranding it: the power flow failed to converge on the very next step, which is the simulator’s way of saying the lights went out.

In none of those cases did the protection object to the command. It could not. Every one of them was a lawful thing to ask for — a breaker operation, the most ordinary action in the building — issued at a moment when it should not have been asked for, or on a circuit that could not afford to lose it.

The same nine checks, a third time

This is the third plant we have put this gate in front of. The first was a chemical reactor; the second, a water treatment works over Modbus TCP.

Not one of the checks changed to move between them. What changes is a profile: this network’s equipment, its written procedures, the physical relationships its instruments must satisfy, and the conditions that belong to a human.

Getting that profile right is most of the work, and it is not guesswork. Every relationship in it was proposed as a candidate and tested against 1,320 snapshots of the network running healthy before it was allowed to refuse anything. One obvious-sounding candidate — no circuit ever runs above 90 percent of its rating, which reads like a description of a well-run grid — was violated 16 times in that healthy data and was thrown out. A check that fires on a normal Tuesday gets switched off by Wednesday, and then it protects nothing at all.

The grid taught us something the other two rigs could not, too. On a water works you can bound how fast a tank level may move, because a tank is an integral and physically cannot jump. On a grid, one lawful breaker operation moves the worst circuit’s loading fifty-two times further than it ever drifts on its own. So rate limits on network state are worthless here — any bound tight enough to catch a fabricated loading would refuse every real switching operation. The cross-checks between instruments do that work instead, because they compare readings at a single instant and do not care whether a breaker just moved.

What this shows, and what it does not

It shows that an AI agent can operate a live transmission network while every action it proposes is independently checked for evidence, authority, procedure and hard limits — and that such a check refuses commands the grid’s own protection provably carries out, because those commands are not the kind of thing protection is built to refuse.

It does not show that this makes an agent safe to run a transmission system. The simulator decides whether the network stays up. The gate decides whether the agent was entitled to ask. Those are different questions, and only the second is ours.

The network is simulated. The power flow, the protection, the cascades and every decision above are not.

If you are putting agents near anything that acts — breakers, pumps, payments, infrastructure — the useful question is not whether the model is clever. It is whether anything between the model and the actuator is able to ask why.

See the check on your own data →