“Even if AI ultimately helps cyber defenders more than attackers, there will likely be a dangerous transition period where attackers can leverage new models much faster than critical infrastructure providers can update their legacy systems.”