AI systems could soon be able to hijack satellites in orbit and cause them to collide with other spacecraft, potentially triggering a dangerous cascade of smash-ups that could render the environment around Earth unsafe for years, according to experts.

Cyber security researchers are already using AI to identify so-called zero-day vulnerabilities — yet undiscovered security holes in code — to alert operators and help them patch the problems before hackers could exploit them. But attackers, too, can take advantage of those advanced systems to find those holes more quickly.

Speaking exclusively to Space.com, researchers at the CR14 cybersecurity center in Estonia said that advances in AI could make it possible for an AI-led attack to wreak havoc in orbit in as little as two years. The emergence of so-called agentic AI — autonomous systems powered by Large Language Models (LLMs) such as OpenAI's ChatGPT or Google's Gemini, which can independently plan action and execute tasks to achieve set goals — is especially worrying, Kristjan Keskküla, CR14 Head of Space Cyber Range, told Space.com. "AI is developing quite quickly right now," Keskküla told Space.com. "The real problem now is that AI can act, take decisions, analyze things and come up with new exploits."

Clémence Poirier, a cyber security researcher at the ETH Zurich University in Switzerland, told Space.com that although no known AI-enabled cyberattack on space systems has taken place so far, state-funded hackers are known to have used LLMs to research space systems vulnerabilities in the past.

"In 2024, OpenAI and Microsoft revealed that Russian threat actor Fancy Bear used LLMs to search about satellite communications, radar systems and other space technologies to support information gathering in view of potential attacks," Poirier said in an email. "AI definitely helps threat actors in the reconnaissance and intelligence gathering phase of an attack. Threat actors can find known vulnerabilities in space systems with LLMs. The time to exploit known vulnerabilities has been immensely reduced because of AI."

Andrzej Olchawa, a space cybersecurity engineer and researcher at VisionSpace told Space.com that "LLMs have drastically lowered the barrier to understanding spacecraft operations and communication protocols."

While in the past, developing an understanding of how space systems operate required extensive study, today, LLMs enable "adversaries with no prior knowledge of the space industry to process documentation and open-source software," and cause real harm.

"Interpreting telemetry and telecommand structures once required extensive study of thousands of technical pages," Olchawa said. "Today, one can simply instruct an LLM to generate parsers and provide mission-specific context with minimal expertise."

What is worse, the accelerated AI threat has emerged just as the space sector began to wake up to the cybersecurity risks, which it had ignored for decades. Many older satellites that are still in orbit and operational have no cyber protection systems in place, said Keskküla, making them a low-hanging fruit for a possible attack.

Many possible ways of attacking a spacecraft exist, including jamming and spoofing of the communication links between the satellites and ground control either from Earth or from space. But the experts are especially worried that hackers could find ways to completely hijack satellites and turn them into orbital anti-satellite weapons.

"They could make them collide with other satellites and cause havoc," Keskküla said. "In the last about three years, we have sent up 8,000 satellites. It's a huge number of satellites, and the constellations are growing. You only need to affect one satellite's actions to cause problems."

The researchers worry that one such deliberate space crash could create thousands of fragments in the heavily used low Earth orbit — the region of space at altitudes up to 1,200 miles (2,000 kilometers) where most satellites reside — which could make the orbital environment unsafe for years.

CR14 is one of the largest cybersecurity research and training centers in the world, and, thanks to Estonia's proximity to Russia, has been at the forefront of Europe's cyber defence against escalating Russian attacks for years.

"During our exercises, we simulate these kinds of attacks in a virtual environment using digital twins," Keskküla said. "We have attackers, and we have defenders, one group trying to penetrate the system and do bad things, the other trying to protect it."

Martin Hanson, CR14's head of communication, added that the quantity and sophistication of cyberattacks is bound to keep rising. Ukraine, he said, experiences "thousands of cyberattacks" on critical infrastructure every day, including on power grids, banks and satellite communication systems.

In Europe, he added, the number of phishing attacks has grown by 500% over the past few years, and the sophistication of those attempts to steal sensitive information by means of social engineering is bound to grow thanks to the use of AI.

"AI will make these attacks more targeted," he said. "They will gather more information about you, and they will try to copy your friends and coworkers. It's getting more sophisticated. "

Weather forecasts, modern banking, international trade and GPS all depend on a fragile web of infrastructure extending from Earth's orbit to the ocean floor — a web that's largely unseen and, experts warn, increasingly at risk.

At a World Economic Forum discussion in Switzerland last week, space leaders and cybersecurity experts cautioned that the satellites orbiting Earth and the submarine cables crisscrossing the seabed — the hidden lifelines of modern society — are growing more vulnerable even as global reliance on them accelerates.

The panel, which included European Space Agency (ESA) Director General Josef Aschbacher, said that technology is advancing faster than the legal, regulatory and security frameworks meant to protect these shared domains. That gap, the experts said, raises concerns about long-term stability and the risk of geopolitical conflict.

"People don't realize how dependent we are," Aschbacher said during the session on Jan. 21. "We have to catch up," he added, when asked whether enough was being done to protect the space infrastructure. "We have to do more."

More than 15,000 active satellites currently orbit Earth, many flying in constellations that provide internet and communications services. SpaceX's Starlink network alone accounts for more than 9,500 of them. If all proposed constellations now under regulatory review move forward, the total could swell to around 500,000 satellites by the late 2030s.

Together with roughly 600 submarine cables spanning the ocean floor, these systems underpin multiple aspects of modern life, supporting everything from navigation and weather forecasting to financial transactions, emergency response and military operations.

"They have two things in common," said Jessica Rosenworcel, executive director of the MIT Media Lab and former chairwoman of the U.S. Federal Communications Commission. "We don't think about them very often ... and they're both extraordinarily vulnerable."

Satellites face threats from tens of thousands of pieces of trackable space debris, as well as millions of untrackable fragments, space weather and cyberattacks. Submarine cables, meanwhile, can be damaged accidentally by marine life or deliberately targeted in geopolitical flashpoints, such as attacks in the Red Sea that interrupted internet access in parts of Asia and the Middle East last year, said Rosenworcel.

"The vulnerabilities are all shared," she said, "but our regulatory frameworks around the world are pretty dated."

Cybersecurity threats are already testing some of those frameworks, according to Robert Lee, the CEO of Dragos, a Washington D.C.-based cybersecurity company. Lee pointed to a thwarted cyberattack on Poland's energy grid last December, which Polish authorities linked to Russian intelligence services. Had it succeeded, the attack could have triggered a blackout, leaving nearly half a million people without heat during the height of winter, according to news reports.

In the space sector, NASA faced an average of one cybersecurity incident per day during a month-long government shutdown in 2019. More recently, ESA launched a criminal investigation after a series of cyberattacks led to the leak of hundreds of gigabytes of potentially sensitive data. The material, which appeared on dark-web forums, reportedly included the agency's proprietary software, authorization credentials and internal project documentation.

Despite the critical role played by data centers and energy grids, Lee said such infrastructure remains "massively underinvested" in cybersecurity resilience — an area "that gets very little attention." In at least one case, he added, a state-backed actor penetrated systems with the explicit intent to cause physical harm.

"We see a lot more than you'll ever see in the media," Lee said during the session. As more systems become interconnected both in space and on Earth, he cautioned that ignoring the "very-real scenarios that are already taking place" could mean "we can very much find ourselves in a world where we're causing societal harm by the very innovation that we're trying to capture."

Still, Lee stressed that effective defense is achievable. "It's not that we are trying to come up with some net-new innovations to keep ahead of the adversaries," he said. "Sometimes it's very basic."

In space, too, rapid growth of satellite constellations can improve redundancy and resilience. But that growth also increases congestion in orbit and raises the risk of collisions and debris incidents.

"This is one of those challenges which reflects on the fact that, very often, tech develops much faster than international laws and regulations that are supposed to govern it," Rafal Modrzewski, the CEO and co-founder of the Finnish radar-imaging company ICEYE, said during the session. "It is a problem that we will have to address as a community."

ICEYE recently signed a €1.7 billion ($2 billion US) contract with the German government to build a 40-satellite radar constellation, one of the largest single Earth-observation deals to date, according to Modrzewski.

Such capabilities are already reshaping how space-based data is used on Earth. In Japan last year, ICEYE's near real-time satellite data was used to accelerate insurance payouts during flooding, allowing compensation to be issued within hours based on detected water depth — sometimes even before affected residents had filed a claim, Modrzewski said.

"You didn't even know that your car was flooded and you had the money in your bank account," he said. "That's the type of future we're talking about — if we can build this infrastructure correctly."

Adding to the complexity, satellites themselves are becoming increasingly autonomous. Recent research has shown that satellites can now use AI to control their orientation in space without human input, reducing the time, cost and operational burden of directing them remotely. But experts say that autonomy also deepens reliance on orbital systems that must operate safely in an increasingly crowded and contested environment.

AI is already being used on the defensive side as well. For example, it was recently used to help protect space assets by identifying vulnerabilities in communication links between Earth and NASA spacecraft, closing a flaw that for three years left the agency's network exposed to potential exploitation. In a worst-case scenario, such vulnerabilities could have allowed attackers to intercept sensitive data or even seize control of spacecraft, including those involved in flagship Mars missions.

Other protective technologies are emerging alongside these software-based defenses. Georgia-based Atomic-6, for example, has developed "space armor" designed to protect onboard communications without interfering with radio signals. The technology has undergone extensive hypervelocity testing on Earth and is expected to face its first in-orbit trials this year.

And more than 100 countries have signed the Zero Debris Charter led by ESA, aimed at strengthening international cooperation to address the growing problem of space junk.

Still, these efforts are only the beginning, Aschbacher said. "We are on Day 1. A lot more needs to be done."

Reflecting on his own journey building a satellite with ICEYE co-founder Pekka Laurila — a project that eventually led to the company's launch — Modrzewski encouraged young people entering the space industry to pursue bold ideas.

"Go and do it," he said. "Solve the problems that are out there, and let's make this world a better place."

The European Space Agency (ESA) is recovering from a string of cyberattacks that leaked hundreds of gigabytes of potentially sensitive data onto dark web forums.

The agency responded by launching a criminal investigation against the unknown hackers. But a leading space cybersecurity researcher warns that many such attacks have previously gone unnoticed and that sensitive data including email credentials of ESA, and also NASA, employees are frequently offered for sale on dark web forums.

ESA got some coal in its stocking this past Christmas. On Boxing Day, reports emerged of a trove of data containing the agency's proprietary software, authorization credentials, access tokens and sensitive project documentation being publicly accessible online. A hacker operating under the code name 888 dumped his cyber loot of more than 200 gigabytes on a dark web forum.

ESA quickly minimized the breach, saying its impact was "limited." But only a week after that statement was made, The Register revealed that a cybercrime group known as Scattered Lapsus$ Hunters stole another 500 gigabytes of data from the agency, claiming the security hole was still unpatched. That batch of data included operational procedures, spacecraft and mission details, subsystems documentation, and proprietary contractor data from ESA partners including SpaceX, Airbus Group, and Thales Alenia Space, according to The Register.

Despite the agency's initially tepid response, ESA representatives said in a press briefing held online on Jan. 8 that the incidents prompted a criminal investigation, which is currently underway.

"ESA is fully cooperating with the authorities," Eric Morel de Westgaver, ESA's director of European, legal and international matters, said in the briefing. "These authorities will manage the communication regarding the case, as those authorities will be in charge of the criminal proceedings."

Cybersecurity researcher Clémence Poirier, of the Center for Security Studies at ETH Zurich, told Space.com that cyberattacks against space agencies are not isolated incidents. In fact, she said that during her research she frequently encounters email credentials of ESA employees as well as other space agencies being sold online on dark web forums.

"It may be due to a lack of cyber hygiene from ESA staff," Poirier told Space.com. "Threat actors may have obtained credentials through infostealer malware, which can harvest web-browser-stored data, which includes credentials, session cookies, [multi-factor authentication] data, saved credit cards, etc."

Infostealers are an insidious type of malware that can evade detection by anti-virus software. These computer viruses often spread through malicious ads embedded in popular websites or infected links in YouTube video descriptions, according to SpyCloud.

Another source familiar with the space cyber risk environment who didn't wish to be named said that space agencies are a common target of cyber attacks. NASA, especially, is a frequent victim of hackers, with vulnerabilities being disclosed "almost every day" via the crowdsourced cybersecurity platform BugCrowd.

Poirier added that, although the content of the recent leaks "did not seem highly critical," it could be combined in the future with data stolen in subsequent breaches to "reveal strategic information that could enable another cyberattack against a space system."

"We are not there yet, but it's important to keep in mind," she said.

She added that vulnerabilities might exist on the side of ESA's software providers or other third parties the agency purchases services from. ESA's own networks might, too, be hiding unpatched security holes that could allow hackers to access confidential information.

"Data leaks and breaches against space agencies are common," Poirier said. "It can happen to each agency and will happen to each agency in the future considering the rise of cyberattacks against the space sector."

Space weather and cyberattacks can cause similar disruption to our civilization's indispensable technology systems. Telling one from the other swiftly and reliably can make billions of dollars' worth of difference to economies that could grind to a halt when such disruptions occur.

Shortly after noon on April 28, the whole of Europe's Iberian Peninsula plunged into darkness. An unknown incident shut down power grids serving Spain, Portugal and parts of Southern France. In an instant, the working day was over for millions of people as anything not powered by a battery suddenly turned off. Trains stopped in their tracks, stranding thousands of commuters, and internet and cellular coverage became patchy.

Weeks later, Spain is still investigating what caused the blackout of the century. A sophisticated cyberattack has been proposed as a possible explanation, but widespread blackouts could also be caused by space weather. Although no solar storm took place on the day of the Spanish blackout, experts worry that the multitude of possible explanations behind such events could delay response times and exacerbate their impacts. In fact, in a recent exercise testing space weather preparedness in the US, similarities between impacts of cyberattacks and solar storms confused participants, highlighting the need for more research into technology vulnerabilities in both cases.

"Space weather can impact systems that use IT for critical functions and everyday processes," James Spann, a senior scientist at the Office of Space Weather Observations at the U.S. National Oceanic and Atmospheric Administration's (NOAA) National Environmental Satellite, Data, and Information Service (NESDIS) department, told Space.com in an email. "These space weather impacts can have the same symptoms as a cyberattack, where systems will be brought down, or lockup, or transmit erroneous information."

NESDIS oversaw a tabletop space weather exercise conducted in May 2024, the first such drill testing the U.S. preparedness for a major solar storm. Results of the exercise, which brought together 35 US government agencies, were published in a report in April.

In one of the simulations during the exercise, NOAA and the U.S. Air Force reported a severe solar flare and radio burst, but another federal department or agency "reported contradictory information, suggesting that the radio and communications disruptions were possibly the result of a cyberattack," according to the report. Above all, it showed the need for effective communication following such events.

In the case of cyberattacks, sophisticated malware and careful planning by computer-savvy malicious actors can disrupt the software systems that control energy infrastructure. Space weather, on the other hand, disrupts power grids by inducing powerful currents in Earth's magnetic field that can trigger surges in power lines and disable transformers.

During intense space weather events, satellite signals struggle to reach Earth through an atmosphere suddenly ionized by clouds of energetic particles arriving from the sun. These same particles can disrupt spacecraft electronics, causing signal errors and in some cases lasting damage to components. Preparation for and recovery from these two types of incidents requires completely different approaches, even though their effects can appear similar.

The space weather exercise overseen by NOAA found that inefficient communication between space weather experts and other government agencies and stakeholders likely to deal with the fallout of these incidents could lead to incorrect conclusions. Wrong conclusions, in turn, can lead to misguided decisions and improper action.

"Deep knowledge of the affected technology is needed, including its vulnerabilities to space weather impacts and cyberattacks, in order to determine the root cause," Spann said.

According to Spann, many technology systems including satellite constellations, especially commercially operated ones, are not necessarily understood well by space weather experts, and therefore the impacts of such events on these systems are difficult to predict.

To help with both preparation and mitigation, researchers and space weather experts need to closely collaborate with operators of satellites and other technologies that are potentially vulnerable to cyberattacks and space weather events, Spann said.

The report found other significant shortcomings in US space weather preparedness. Coronal mass ejections (CMEs) — large clouds of magnetized plasma that erupt from the sun's atmosphere — are the main cause of solar storms on Earth. These clouds can take up to three days to reach the planet. At first glance, that should provide abundant time for a timely warning.

The lack of measurements in space, however, means that scientists can only form an accurate idea of the expected impacts about half an hour before the CME hits Earth. That's because the only fixed space weather monitoring probe in Earth's orbit is located in the Lagrange Point 1 about 900 miles (1,500,000 kilometers) away from Earth toward the sun.

Space weather forecasters can occasionally use data from scientific probes observing the sun, such as the European Space Agency's (ESA) Solar Orbiter or NASA's STEREO mission. These satellites, however, are not always at the right position to provide the needed measurements.

"There are many observations that we know would improve forecasting and nowcasting of space weather that we don't have," Spann said. "We know this because we have seen the value of these observations either when we temporarily had them or from models that showed us that we could improve our forecasts and nowcasts if we had a certain type of data."

Whether NOAA will be able to invest into such new missions, however, is uncertain as the agency is facing widespread budget cuts due to decisions by the Trump administration.

The impacts of space weather on our society are increasing with our growing dependence on space technologies. In low Earth orbit — the region of space up to the altitude of 600 miles (1,000 kilometers) — satellites struggle during solar storms due to the increased atmospheric drag caused by the energetic particles from the sun. Satellites can lose significant altitude during these events, prompting emergency maneuvers to prevent them from spiraling toward Earth. Such frantic maneuvering in turn creates chaos that prevents space situational awareness experts from making correct estimates of trajectories and possible collisions.

"In low Earth orbit, due to the growing satellite numbers, more observations are very much needed," said Spann. "Likewise, there is a need to improve forecast models to provide longer lead times with associated uncertainties."

Since the current solar cycle — the 11-year pattern in the rise and fall of solar activity — picked up strength in early 2021, at least two solar events have occurred that caused significant problems in Earth's orbit.

In 2022, SpaceX lost a batch of freshly launched Starlink satellites as the spacecraft couldn't raise their orbits using their on-board thrusters in the thickened air. In May 2024, the Gannon Solar Storm, the strongest solar storm in two decades, caused widespread chaos in low Earth orbit as thousands of satellites began to maneuver at the same time to make up for the altitude loss.

NASA’s internal computer network is full of holes and is extremely vulnerable to an external cyberattack, an audit by the Office of the Inspector General has found. Even worse, it appears several of the vulnerabilities have been known for months, yet remained unpatched.

“Six computer servers associated with IT [information technology] assets that control spacecraft and contain critical data had vulnerabilities that would allow a remote attacker to take control of or render them unavailable,” the audit report released today (March 28) by Inspector General Paul K. Martin said.

“The attacker could use the compromised computers to exploit other weaknesses we identified, a situation that could severely degrade or cripple NASA’s operations,” the report continued. “We also found network servers that revealed encryption keys, encrypted passwords, and user account information to potential attackers.”

It is not unusual for previously unknown network security holes to be found in large organizations. In that light, Martin’s audit might have been seen as positive for revealing the vulnerabilities.

But it’s long been known that security on NASA networks is weak. Martin’s office released a previous audit report nearly a year ago, and since then nothing has been done to remedy the situation.

“In a May 2010 audit report, we recommended that NASA immediately establish an IT security oversight program for this key network,” today’s report reads. “However, even though the Agency concurred with the recommendation it remained unimplemented as of February 2011.”

“Until NASA addresses these critical deficiencies and improves its IT security practices,” it goes on to say, “the Agency is vulnerable to computer incidents that could have a severe to catastrophic effect on Agency assets, operations, and personnel.”

A Government Accountability Office report in October 2009 was similarly critical of the agency, finding that “NASA has not yet fully implemented key activities of its information security program to ensure that controls are appropriately designed and operating effectively.”

NASA’s servers have been broken into many times in the past. Martin’s new report mentions two serious breaches in 2009, during one of which intruders stole “22 gigabytes of export-restricted data from a Jet Propulsion Laboratory (JPL) computer system.”

British hacker Gary McKinnon is awaiting extradition to the U.S. for allegedly hacking into NASA’s networks, as well as those of the Department of Defense, in 2001 and 2002.

Martin’s office recommends that NASA “expedite implementation of our May 2010 recommendation to establish an IT security oversight program for NASA’s Agency-wide mission network.”

You can read the full report here.

This story was provided by SecurityNewsDaily, a sister site to SPACE.com.