Study finds AI models plot infrastructure attacks in 90% of attempts

Cybersecurity company Frenos said it tested 10 artificial intelligence models on their ability to identify weaknesses and develop attack strategies against industrial systems, finding that leading commercial systems produced workable cyberattack plans in roughly 90% of attempts. The study involved 16,980 tests including 13,884 individual decisions, 2,520 complete attack plan attempts and 576 simulated runs, according to the firm. The examination focused on industrial control systems that manage essential services including water treatment and electrical distribution networks.

Three top commercial AI models achieved success rates between 89.5% and 92.9% when developing attack plans, while other systems performed worse, with the strongest foreign open-weight model reaching 36.2% and the best US open-weight model managing only 5.2%, Frenos said. Researchers declined to disclose the specific names of the tested models, noting that the evaluations relied on supplied information and simulated environments rather than real-world infrastructure targeting. The disparity between commercial and open-weight performance highlights significant gaps in security safeguards across different AI architectures, according to the findings.

Technical limitations and recent incidents

Frenos said the models sometimes omitted critical operational steps or assumed access privileges they did not possess, stressing that the research did not demonstrate AI capability to independently identify targets or execute attacks without human direction. The findings surface amid growing alarm over industrial system vulnerabilities, including a recent French incident where hackers manipulated supermarket refrigeration systems to spoil food and start fires, and a January attack on a Mexican water utility where assailants used Anthropic's Claude AI to identify monitoring interfaces before failing to breach operational controls.

Mitigation strategies

The company urged critical infrastructure operators to implement stronger network separation, restrict remote access pathways and intensify monitoring of suspicious activity to reduce exposure to AI-assisted reconnaissance. Enhanced segmentation and strict access controls remain essential defenses as automated tools become increasingly capable of mapping vulnerabilities in water and power distribution networks, Frenos said. Utility operators must also verify that AI systems cannot bypass existing authentication protocols through automated social engineering techniques, the firm added.