AI Models Show Growing Ability to Plan Industrial System Attacks

Cybersecurity company Frenos found that three of 10 AI models produced successful industrial attack plans in roughly 90% of attempts. The research shows AI becoming more capable of planning attacks against power and water systems. The researchers evaluated models on planning attacks against industrial systems, including software used to monitor water treatment.

Frenos found substantial differences among the models' results. Three models that the researchers classified as frontier models succeeded in 17.9% to 31.9% of attempts. The best-performing foreign open-weight model achieved a 36.2% success rate. The best-performing U.S. open-weight model achieved a 5.2% success rate. Frenos withheld the tested models' names.

The research involved nearly 17,000 tests, including 2,520 attempts to develop complete attack plans. The researchers supplied information about possible targets and asked the models to assemble steps toward specified objectives. Frenos co-founder and CTO Harry Thomas said the researchers guided the models with a relatively simple setup. More sophisticated tools supplying additional context and feedback could improve performance. Thomas said a more capable framework could have given the models a greater advantage.

Critical infrastructure operators have diminishing time to prepare, and freely available AI models will eventually make attacks easier to carry out. Steve Swick, a former senior security executive at American Electric Power, told reporters that the threat was advancing at an unprecedented pace. Nation-state adversaries and cybercriminals have long targeted water systems, manufacturing plants and other critical services. Many operators lack sufficient staff and funding. System testing and upgrades can also threaten essential services with disruptions that operators cannot afford. Industrial systems can react badly to unexpected traffic or commands, unlike conventional corporate networks. Even failed attacks could interrupt essential operations.

Thomas said AI could discreetly map systems and locate weaknesses after attackers enter an industrial network, without human hackers' time limitations. Thomas said AI does not need food, sleep or bathroom breaks. Paul Shaver, head of operational technology at cybersecurity company Armadin, said AI agents can already perform reconnaissance and process extensive data without necessarily setting off security alerts.

Initiatives from the White House, frontier AI companies and cybersecurity organizations have emerged in recent weeks to reduce costs and supply resources for critical infrastructure organizations.