Will Misconfigured AI Take Down a G20 Nation’s Critical Infrastructure?

Analyst firm Gartner predicts that by 2028, misconfigured AI (Artificial Intelligence) will shut down national critical infrastructure in a G20 nation. Gartner is advocating that safe overrides should exist in national critical infrastructure in case such misbehaving AI takes down critical systems.

Shortly before Gartner’s view, Moltbook, a social network populated not by humans but by AI agents, showed that the AI agents could create content and even invent philosophies and religions. While some organisations, and even governments, are touting AI as a “saviour,” the inherent and obvious challenges remain, on top of an impending AI bubble.

Gartner’s warning that misconfigured AI could shut down national critical infrastructure in a G20 country by 2028 should not be dismissed as speculative. It reflects a structural reality: AI systems are being embedded into energy grids, transportation networks, healthcare platforms, and financial services faster than governance, identity controls, and configuration management frameworks are maturing.

Misconfigured AI and the Likeliest Failure Scenario

The most likely failure scenario is not a rogue superintelligence. It is misconfiguration, where human error is amplified by automation and scale. AI systems rely on complex webs of privileged accounts, API keys, service identities, automation scripts, and third-party integrations. When those identities are poorly governed, over-permissioned, or left unmonitored, they introduce systemic fragility.

As AI adoption accelerates, non-human identities, including service accounts, automation tokens, and AI agents, now outnumber human users in many infrastructure environments, dramatically expanding the attack surface. These identities often operate with persistent privileges and limited oversight. A single compromised credential or flawed model deployment pipeline can cascade across interconnected infrastructure environments.

As automation expands, so does the blast radius of failure. AI does not eliminate risk—it accelerates it when guardrails are weak. Critical infrastructure operators must apply enforceable identity governance across human and non-human identities alike. Zero-trust architecture, least-privilege access enforcement, and continuous monitoring of privileged accounts must extend to AI models, training environments, and the cloud infrastructure that supports them.

Regulatory pressure is intensifying across the EU, UK, and US. Frameworks such as the NIS2 Directive, the Digital Operational Resilience Act (DORA), and the EU AI Act place explicit accountability on executive leadership for operational resilience and secure system design. AI governance is no longer a technical consideration. It is a board-level obligation and a matter of national resilience.

The Criticality of Override Mechanisms vs. Misconfigured AI

Safe override mechanisms are essential in AI-enabled operational technology environments because of the threat of misconfigured AI. However, override controls are only effective when identity systems are hardened and access pathways are tightly controlled. Without unified visibility and control over privileged access, organisations cannot credibly claim operational readiness in an AI-driven infrastructure landscape.

National resilience in the AI era will depend less on model sophistication and more on operational discipline. Boards and regulators should treat AI configuration governance as a core resilience metric, not a technical afterthought.