AI Helps Low-Skill Attackers Plan Industrial Control System Attacks at 90% Success

What happened

Why it matters

• ·Critical infrastructure operators now face a materially larger pool of potential attackers. Anyone with access to a frontier AI model can attempt attack planning that previously required rare expertise. This makes historical threat-model assumptions unreliable and may affect risk assessments required under frameworks such as the Five Eyes Guidance on the Careful Adoption of Agentic AI Services.
• ·Operational security teams and compliance programs built around the assumption that sophisticated infrastructure attacks require expert adversaries need to be revisited. As noted in 88% of OT Security Leaders Claim Maturity; Only 21% Have a Complete Asset Inventory, most organizations lack a complete picture of the operational assets they need to protect, which compounds this risk.
• ·Risk and audit committees must treat AI-assisted attack planning as a named threat category in critical infrastructure risk registers, not a speculative future risk. Boards that receive AI risk reports without this category may be receiving an incomplete picture of the organization's exposure.

Governance controls affected

What to do now

• ☐Ask your security team whether your current threat models for operational technology and industrial control systems account for low-skill attackers using AI to plan attacks, and update those models if they do not.
• ☐Request a current inventory of all operational technology and industrial control systems that connect to corporate networks or the internet, and confirm each one appears in your risk register.
• ☐Commission or schedule adversarial testing of your industrial control and operational technology environments that explicitly includes AI-assisted attack scenarios, not only traditional penetration testing methods.
• ☐Review your board and audit committee AI risk reports to confirm AI-assisted infrastructure attack planning is listed as a named threat category with a defined risk rating.
• ☐Check whether your cyber incident response playbook covers operational technology disruption scenarios specifically, including who has authority to isolate industrial systems and how that decision is escalated.

What to watch next

The Frenos findings are part of a broader pattern: regulators and standards bodies are beginning to treat AI-assisted attacks on physical infrastructure as a named category requiring specific controls. Compliance teams should monitor whether bodies such as CISA issue updated guidance that references AI-lowered attack barriers for critical infrastructure. The EU AI Act (Regulation (EU) 2024/1689) already classifies AI used in critical infrastructure management as high-risk, and enforcement attention on that category is likely to grow. Teams should also watch for follow-on research testing whether hallucinations remain a limiting factor as models improve. A reduction in hallucination rates would close the main gap the Frenos study identified.