The key facts
- Frenos ran 16,980 tests of 10 AI models on planning attacks against industrial water and power systems
- Three leading commercial models produced workable attack plans in 89.5–92.9% of attempts; the best foreign open-weight model scored 36.2%, the best American one 5.2%
- The tests were simulations; model names were not disclosed
AI models drew up attack plans in ~90% of attempts
A study published on Wednesday showed that some of the most advanced AI models successfully developed plans for cyberattacks on critical infrastructure, including water and power supply systems, in roughly 90% of attempts. The company Frenos tested 10 models for the ability to identify vulnerabilities, assess access requirements, and plan attacks on industrial systems that provide basic services.
Scale of testing and results
The study included 16,980 tests: 13,884 individual decisions, 2,520 attempts to compose full attack plans, and 576 simulated runs. Three leading commercial models created workable attack plans in 89.5–92.9% of planning attempts, while other models performed significantly worse. The strongest foreign open-weight model achieved success in 36.2% of cases, and the best American open-weight model in 5.2%. The researchers did not disclose the names of the models.
Limitations of the study
Frenos emphasized that the tests used provided information and simulated scenarios, not real attacks. The models sometimes skipped critical steps or assumed access they did not have. The study did not show that AI is capable of independently identifying targets or carrying out cyberattacks.
Incident context
The results were published amid growing concern about attacks on industrial systems. Frenos mentioned a recent incident in France, where hackers manipulated cooling systems in hundreds of supermarkets, causing a sharp rise in temperature, spoilage of food, and, according to reports, fires. The company also cited a January cyberattack on a Mexican water supplier, in which attackers used Anthropic's Claude AI to identify an industrial monitoring interface and suggest additional access attempts. Those attempts failed, and compromise of operational control systems was not confirmed.
Company recommendations
Frenos urged critical infrastructure operators to strengthen network segmentation, restrict remote access, and monitor suspicious activity to reduce the risk of AI-enabled attacks.
