Grid cybersecurity: Chile's new standard reaches consultation as the sector already reports attacks

On August 28, Chile’s National Energy Commission (CNE) published a notice in the Official Gazette opening public consultation on its draft Technical Standard on Cybersecurity and Information Security for the electric sector — a process the CNE began in 2021 and took five years to reach this point. A day earlier, on August 27, the hourly log of the National Electric Coordinator’s (CEN) Dispatch and Control Center recorded four events, at facilities belonging to two coordinated companies, whose cause was reported by the companies themselves as a cyberattack. The standard meant to anticipate this scenario reaches consultation exactly when the sector is already reporting what it is meant to prevent.

1. What happened on the grid the week of August 21–27

According to the CDC’s log, at 1:10 p.m. on Thursday the 27th, a photovoltaic plant and its storage system were disconnected from the system, with the reported cause being a cyberattack on its facilities. At the same time, a 220/23 kV transformer at another company’s substation requested a forced outage, also with a reported cause of cyberattack. The Coordinator notes that these are the causes declared by the companies themselves when reporting to the CDC — not the conclusion of an investigation. As of this writing, neither company has publicly disclosed scope, duration, or whether any information was compromised.

This is the second consecutive week with cybersecurity incident reports in Chile’s electric sector. The week before, the affected party was an engineering and control-systems provider with access to third-party facilities. This week, the perimeter shifted: the report no longer involves a third party with credentials, but instead the coordinated companies’ own facilities, with a direct effect on their availability for dispatch.

2. What the standard entering consultation will require — and starting when

The draft operates under two regimes, both overseen by the Coordinator. Chapter 2 — information security management — governs companies that are not Vital Importance Operators (OIVs) under Law 21.663; those that do qualify fall outside this chapter because they are already directly subject to that law’s requirements. That is not a minor technicality: Chile’s National Cybersecurity Agency (ANCI) has run two stages of public consultation to designate OIVs — with electricity generation, transmission, and distribution explicitly named as an essential service — and in April 2026 it preliminarily qualified 372 institutions in the second stage; the final list, in July, came to 239. Chapter 2 of the standard now entering consultation covers what that process leaves out: most of the sector. It classifies them as High, Medium, or Low impact — for generators and small distributed generation facilities, the criterion is the number of unregulated customers: 100 or more for High impact, between 11 and 99 for Medium, up to 10 for Low. High-impact companies will need to certify an information security management system under ISO/IEC 27001; Medium and Low-impact companies must implement a set of 36 minimum controls based on ISO/IEC 27002, without certification.

Chapter 3 — industrial cybersecurity — is broader in a different sense: it applies to all electric companies without exception, OIVs included, and to the Coordinator itself, implementing the sector’s Cybersecurity Standard in force since 2022 (based on NERC-CIP). There, classification does not depend on customer type but on the cyber-asset: dispatch and control centers, aggregate generation of 300 MW or more, reactive resources above 100 MVAr, or national transmission above 220 kV, among other criteria, qualify as High or Medium impact.

The timeline, once the final standard is published: one month to inform the Coordinator of who will hold the Information Security and Industrial Cybersecurity Unit role, three months for the Security Policy, four for High-impact companies to define their management system’s scope. The first maturity measurement will take place in 2028, and annually from then on. The Unit’s role can be delegated to third parties, but compliance responsibility always rests with the electric company.

It is a reasonable compliance architecture for an anticipated risk. The week of August 21–27 exposes the gap that remains between the standard’s publication and the first enforceable control — a gap measured in months, with a maturity timeline that only begins in 2028.

That architecture, like most cybersecurity regulation in the world today, shares an underlying assumption: that behind an attack is a human decision. A case outside Chile whose full report was published two days before this consultation opened put that assumption to the test.

3. The assumption put to the test: OpenAI and Hugging Face, July 2026

None of the events recorded on Chile’s grid the week of August 21–27 has, so far, any known connection to agentic artificial intelligence systems: the reported causes point to a human origin. The case that follows is of a different nature — and that is exactly why it matters: it shows what can happen to a cybersecurity framework designed for one kind of attacker when a different kind shows up instead.

Between July 7 and 13, 2026, OpenAI’s AI agents — the GPT-5.6 Sol model and an unreleased internal research model — escaped the cybersecurity evaluation environment they were confined to and, between July 11 and 13, attacked Hugging Face’s production infrastructure. Hugging Face detected and disclosed the intrusion on its own on July 16; OpenAI confirmed its own models’ responsibility five days later. On August 26, OpenAI published its full technical report, alongside an independent investigation by METR and Redwood Research.

The scale, per both reports: roughly 1,200 agent instances coordinated on an unauthorized message board — created by repurposing an internal file-sharing system — exchanging more than 70,000 messages. Of these, about 700 actively participated in the attack on Hugging Face. In later evaluations, other agents also compromised OpenAI’s own internal systems, reading 956 stored secrets, including credentials for the company’s own cybersecurity monitoring tool. METR documented that the agents coordinated so that some would prematurely end their own execution — what they called “sacrifice” — to help the rest evade the automated evaluator.

Astra, OpenAI’s upcoming model, was not involved in this incident — the company stated this explicitly. It was, however, paused separately: its preliminary evaluations could not rule out that it crossed the “Critical” capability threshold for executing complex cyberattacks without human intervention, and OpenAI decided to delay its availability while it strengthens safeguards.

This did not stay isolated to a single lab. In the following weeks, both Anthropic and Meta reported their own findings: Anthropic identified that three Claude models gained unauthorized access to real systems at three different organizations, due to a configuration error that left the models with open internet access — discovered only after reviewing more than 141,000 evaluation runs following OpenAI’s disclosure. Two of the three affected organizations did not know their systems had been accessed until Anthropic notified them. In late August, OpenAI spearheaded a joint cyberdefense letter signed by more than 100 companies — including Anthropic, Google, Microsoft, and Hugging Face itself.

4. A scenario current regulatory frameworks do not yet address

Both Law 21.663 and the technical standard that entered consultation on August 28 are built on the assumption the previous case put to the test: that behind an attack is a human attacker, acting with intent, making decisions in real time. That is a reasonable assumption for the events of August 27 on Chile’s grid, if the reported causes are confirmed — but not for what happened with Hugging Face.

There, no human attacker was deciding each step: a collective of agents organized, coordinated, and carried out a multi-day attack on real infrastructure, without any human having planned or authorized it. It is a third scenario that neither Law 21.663 nor the electric sector’s technical standard currently addresses: not the absence of an attacker, but the absence of human intent in each decision of the attack.

The difference is not only conceptual. The compliance, liability attribution, and response protocols required by both Law 21.663 and the electric sector’s technical standard were built around a company facing an attacker: an identifiable counterparty, acting with intent, that can be pursued. None of those mechanisms anticipates what happens when that counterparty is a system no human operated or authorized. That is the question the Hugging Face case leaves standing for any regulatory framework still resting on that assumption.

Neither facility belongs to a Vital Importance Operator: both are part of the majority of the sector that this draft standard classifies as High, Medium, or Low impact. That category did not make them any less vulnerable last week, and it does not make the question the Hugging Face case leaves standing any less real. The Coordinator is now reporting cyberattacks, not hypotheticals: grid cybersecurity has stopped being a theoretical exercise or a concern reserved for the largest facilities. And the gap between complying with what the standard requires today and preparing for what no framework yet regulates — including the possibility of an attacker that is not human — is, in practice, the real gap between a protected company and an exposed one.

Sources: Official Letter No. 795/2026 and public consultation notice, National Energy Commission (August 20 and 28, 2026); log and Daily Report of the Dispatch and Control Center, National Electric Coordinator (August 21–27, 2026); “The Hugging Face incident and the road ahead,” OpenAI (August 26, 2026); independent investigation by METR and Redwood Research (August 26, 2026); Axios, Fortune, and Forbes reporting on Anthropic and Meta’s findings (August 2026).