Dear Editor,
An AI agent was assigned a routine research task: find Australian government figures on spending for medicines. In pursuing that task, it accessed files on a government health statistics website that it was not authorised to access. The agent was developed by OpenAI, not Anthropic.
This incident should concern country St. Maarten because the island already knows how long the effects of a cyberattack can last. On March 17, 2022, a ransomware attack brought public utility company NV GEBE to a standstill and disrupted its billing and collection operations which still live on today. Four years later, questions about customer balances dating from the affected period remain, however, GEBE continues to work diligently to resolve this matter.
The GEBE attack was not caused by an AI agent. It demonstrates something equally important: when a critical organisation loses control of its digital systems, the consequences can continue long after the initial incident. Records, revenue, customer confidence and the ability to plan future investments can all be affected.
Critical infrastructure consists of the services and systems whose prolonged disruption could seriously harm public safety, government operations or the economy. St. Maarten’s security service, VDSM, specifically identifies government, the airport, seaport, telecommunications companies, hospital and utilities as vital components.
These systems depend on one another. A telecommunications failure can obstruct emergency coordination. A power disruption can affect healthcare and payments. Problems at the port or airport can delay supplies. On a small island, the public may have few alternative providers when one essential service fails.
National security includes the ability to protect lives, maintain public order and keep the country functioning during a crisis. VDSM explicitly describes hacking or shutting down the water and electricity company, telecommunications companies, port or airport as a potential threat to St. Maarten’s vital interests and national security.
Consider a cyber incident during hurricane season. If utility systems are disrupted while telecommunications are unreliable, emergency services may struggle to coordinate and residents may struggle to receive trusted instructions. If hospital systems or supply records are also unavailable, the difficulty compounds. This is a risk scenario, not a claim that these systems have been compromised.
There is an economic security dimension as well. Tourism depends on functioning transport, utilities, communications and payment systems. A serious interruption can quickly affect jobs, businesses and public revenue. The GEBE experience shows that recovery must also account for records and customer relationships; restoring computers alone does not necessarily resolve the consequences of lost or disputed information.
AI agents could increase the pressure on these systems. Depending on the permissions they receive, agents can browse websites, retrieve files, run code and act through connected tools. Some may take unintended actions while pursuing an authorised task; criminals may also direct agents to assist attacks.
Separately, researchers have observed harmful agent behaviour in controlled simulations. Those simulations are warning signs, not accounts of real-world damage.
Country St. Maarten needs to start with a shared picture of essential services. Under the current rapid advancement of AI technologies, government and operators should identify the digital systems each service needs, the suppliers with access to them and the consequences of losing them for a day, a week or longer. The assessment should include billing, records and public communications alongside physical operations. These measures remain fundamental as threats evolve.
Stakeholders along with VDSM need to practice a joint response. Utilities, telecommunications providers, the port, airport, healthcare providers and government should rehearse how they would communicate and maintain essential services during a cyber incident. Each operator needs a route to alert the others promptly.
Small islands like St. Maarten cannot always maintain every specialist capability alone. Trusted partners can assist with training, technical advice and incident response.
The Australian incident warns that a powerful agent can cross a boundary while pursuing an otherwise legitimate task. The GEBE attack showed St. Maarten what a major digital disruption can mean in practice – and how long its effects can endure.
Together, they make the case for treating cyber resilience as part of national security: protecting essential systems, preserving the records behind them and preparing to keep the country functioning when one of them fails.
Roddy Heyliger
