AI Helps Low-Skill Attackers Plan Industrial Control System Attacks at 90% Success
What happened
Frenos published research covering 16,980 tests run between October 2025 and September 2026. The research examined how well AI models could help someone plan attacks against industrial control systems and operational technology. That category covers the software and hardware running power grids, water treatment, manufacturing, and similar physical infrastructure. Top frontier AI models succeeded in roughly 90 percent of attack-planning attempts. Consistency varied across models, and hallucinations, where the AI produced plausible but incorrect technical details, remained a limiting factor that reduced reliability without eliminating the threat. The practical implication is that AI is compressing what once required months of specialized training into a task a less-skilled attacker can attempt with a commercial AI tool. This finding builds on a pattern of research, including AI Agents Executed All 8 Critical Infrastructure Attacks in Booz Allen Lab Tests. The threat to physical infrastructure is no longer theoretical.
Why it matters
- ·Critical infrastructure operators now face a materially larger pool of potential attackers. Anyone with access to a frontier AI model can attempt attack planning that previously required rare expertise. This makes historical threat-model assumptions unreliable and may affect risk assessments required under frameworks such as the Five Eyes Guidance on the Careful Adoption of Agentic AI Services.
- ·Operational security teams and compliance programs built around the assumption that sophisticated infrastructure attacks require expert adversaries need to be revisited. As noted in 88% of OT Security Leaders Claim Maturity; Only 21% Have a Complete Asset Inventory, most organizations lack a complete picture of the operational assets they need to protect, which compounds this risk.
- ·Risk and audit committees must treat AI-assisted attack planning as a named threat category in critical infrastructure risk registers, not a speculative future risk. Boards that receive AI risk reports without this category may be receiving an incomplete picture of the organization's exposure.
Stay ahead of stories like this
Get every Global AI governance development like this one, plus the rest of the week's developments. Every Thursday.
Recent issues
- State-linked attackers and criminal operators are actively weaponizing AI tools as entry points into enterprise systems, turning internal platforms and open-source frameworks into live attack vectors.5 Nov
- Three separate incidents this week each created a new compliance action item: verify your AI vendors' data sourcing, demand agent monitoring coverage guarantees, and audit trusted app identities in your cloud environment.29 Oct
Free every Thursday. Unsubscribe anytime.
Governance controls affected
What to do now
- ☐Ask your security team whether your current threat models for operational technology and industrial control systems account for low-skill attackers using AI to plan attacks, and update those models if they do not.
- ☐Request a current inventory of all operational technology and industrial control systems that connect to corporate networks or the internet, and confirm each one appears in your risk register.
- ☐Commission or schedule adversarial testing of your industrial control and operational technology environments that explicitly includes AI-assisted attack scenarios, not only traditional penetration testing methods.
- ☐Review your board and audit committee AI risk reports to confirm AI-assisted infrastructure attack planning is listed as a named threat category with a defined risk rating.
- ☐Check whether your cyber incident response playbook covers operational technology disruption scenarios specifically, including who has authority to isolate industrial systems and how that decision is escalated.
What to watch next
The Frenos findings are part of a broader pattern: regulators and standards bodies are beginning to treat AI-assisted attacks on physical infrastructure as a named category requiring specific controls. Compliance teams should monitor whether bodies such as CISA issue updated guidance that references AI-lowered attack barriers for critical infrastructure. The EU AI Act (Regulation (EU) 2024/1689) already classifies AI used in critical infrastructure management as high-risk, and enforcement attention on that category is likely to grow. Teams should also watch for follow-on research testing whether hallucinations remain a limiting factor as models improve. A reduction in hallucination rates would close the main gap the Frenos study identified.