Research from cybersecurity firm Frenos shows that advanced AI models can create attack blueprints for critical services such as water-treatment and other industrial control systems. The study highlights substantial variation in capability across models and warns that freely available tools could make such attacks easier to carry out.
What the research did
Frenos evaluated ten AI models on their ability to plan attacks against industrial systems. The experiment covered nearly 17,000 individual tests, including 2,520 attempts specifically aimed at producing complete, actionable attack plans.
- Three of the ten models produced attack plans successfully in roughly 90% of attempts.
- Three models that the researchers labeled as frontier-capable succeeded only between 17.9% and 31.9% of the time.
- The strongest foreign open-weight model achieved a 36.2% success rate, while the strongest U.S. open-weight model succeeded in just 5.2% of attempts.
Frenos did not disclose the names of the models that were tested.
How the tests were run
Models were given information about potential targets and tasked with assembling the steps needed to meet specified objectives, for example manipulating a water-treatment process. The researchers used a relatively simple control setup to guide the models; they noted that more sophisticated tooling that provides additional context and feedback could further improve model performance.
Why this matters
Critical services such as water systems and manufacturing plants have long been targets for nation-state actors and cybercriminals. Many operators face staffing and budget constraints, and routine testing or upgrades can risk disrupting essential services.
Industrial systems are also sensitive to unexpected traffic and commands, meaning that even unsuccessful attack attempts can cause operational disruptions. Harry Thomas, Frenos co-founder and CTO, warned that once an attacker gains access to an industrial network, AI can quietly map systems and identify weaknesses without the time constraints humans face: "AI doesn't have the problem with patience," he said.
Paul Shaver, head of operational technology at cybersecurity firm Armadin, added that AI agents can already perform reconnaissance and analyze large volumes of data without necessarily triggering security alerts.
Broader implications and response
The Frenos results indicate that the risk is not limited to closed, top-tier models: publicly available models and relatively simple supporting tools could lower the bar for executing these kinds of attacks. Several recent initiatives — involving the White House, frontier AI companies, and cybersecurity organizations — aim to reduce costs and provide resources to help critical infrastructure operators shore up defenses.
Conclusion
Frenos' extensive testing reveals that AI increasingly can plan attacks on industrial systems, though capabilities vary widely by model. The findings underscore the need for accelerated cooperation among operators, governments, and industry to strengthen protections and reduce vulnerabilities.
