AI models can plan attacks on industrial systems, study finds

AI models can draft workable plans for attacks on industrial control systems, but they remain unreliable and still need human judgement, according to a report published by OT security firm Frenos on 21 October 2026.

Frenos, which sells AI-driven penetration testing for operational technology (OT) environments \u2014 the computers that run physical equipment such as power grids and water plants \u2014 ran several AI models through 16,980 tests between October 2025 and September 2026. The tests comprised 13,884 decision attempts, 2,520 planning attempts and 576 simulated attacks. The company said it tested six frontier models, two US open weight models and two foreign open weight models, but would not name the models or their providers.

The tasks covered three areas: choosing a single action, planning the steps towards a goal, and working through a simulated scenario. Each model was given background on assets, networks and known weaknesses, plus the access each action required, before being asked to choose. Frenos then checked whether the choice matched the required outcome. Depending on the model, between 6 and 47 per cent of choices passed.

The three strongest frontier models succeeded in roughly 90 per cent of their planning attempts, meaning they produced a workable attack plan. But they were not consistent. Only 60 per cent, 62.9 per cent and 74.3 per cent of their plans passed every repeat run. "A plan can look sensible and still leave out something essential," the report said. "The models had information about the task, but some answers skipped a step or assumed access that the plan had not established."

The best of the four open weight models, a non-US one, reached a 36.2 per cent overall success rate. That beat three US frontier models, which scored 31.9 per cent, 18.8 per cent and 17.9 per cent.

Harry Thomas, chief technology officer and co-founder of Frenos, said the models remain prone to hallucinations. "We still think human judgment remains essential for these AI models to make the threat actors achieve whatever mission or goal they're trying to achieve," he said. He noted two limits on the study: no human corrected the models' plans during testing, and the test harness was simple. "A more capable harness could have given these AI models more of an edge," he said.

Speaking on a media panel ahead of the report's publication, OT security practitioners said AI is already shortening the work of reconnaissance. Paul Shaver, head of OT at Armadin \u2014 a startup founded by Kevin Mandia that uses swarms of autonomous AI agents to simulate attacks \u2014 said he can download the manual for almost any automation controller and parse it quickly to find ways to exploit features that were not secure by design. Shaver said that with AI help he is "very quickly building tools in days that would normally have taken me months".

Shaver stopped short of saying low-skilled attackers are now nation-state grade. "I'm not going to say the potential is not there, because the tools are improving such that the access to information is so much quicker," he said.

Steve Swick, former chief information security officer at American Electric Power, said utilities have long relied on security by obscurity, and that "the knowledge needed to do some of that stuff is getting less likely to be necessary".

Thomas said the broader effect is on timing. "If a better-than-average script kiddie can now perform attacks, you have more threat actors out there," he said, adding that defenders may no longer know who their adversary is.

Frenos recommends layered defence: segmenting networks, limiting remote access and user permissions, and testing recovery steps.