AI Models Achieve 90% Success Rate Planning Cyberattacks on Power Grids and Water Systems

AI Models Demonstrate Alarming Success in Planning Infrastructure Attacks

AI models have reached a troubling milestone in their ability to plan cyberattacks against critical infrastructure. New research from cybersecurity company Frenos shows that three out of 10 AI models tested successfully constructed attack plans against industrial systems in roughly 90% of attempts2

2

. The study, which ran 16,980 tests between October 2025 and September 2026, examined how AI-driven cyber threats could target power grids, water systems, and manufacturing plants1

1

.

The research included 13,884 decision attempts, 2,520 planning attempts, and 576 simulated attacks across six frontier models, two US open weight models, and two foreign open weight models1

1

. Performance varied dramatically: while the strongest three frontier models achieved approximately 90% success in planning attempts, three other frontier models succeeded in just 17.9% to 31.9% of attempts2

2

. The strongest foreign open-weight model succeeded 36.2% of the time, while the strongest US open-weight model succeeded just 5.2%2

2

.

How AI Accelerates Attacks on Critical Infrastructure Systems

AI-powered cyberattacks fundamentally change the threat landscape for attacks on critical infrastructure systems. "It's a clock that is moving faster than we've ever seen," said Steve Swick, former chief information security officer at American Electric Power2

2

. The technology enables faster reconnaissance, documentation analysis, and exploitation of vulnerabilities in operational technology (OT) environments.

Paul Shaver, head of OT at Armadin, explained how AI transforms the attack process: "Basic access can recon documentation, and distill through that documentation very quickly to find out critical design features of your plant and facility. I can download the manual for almost any automation controller, parse through that very quickly, and come up with ways that I can exploit a dedicated feature of something that was not secure by design"1

1

. At Armadin, Shaver reports building tools in days that would normally take months with AI assistance1

1

.

Harry Thomas, CTO and co-founder of Frenos, highlighted another advantage: "AI doesn't have the problem with patience. It doesn't need to eat. It doesn't need to sleep, and it doesn't need to use the restroom"2

2

. This tireless capability allows AI agents to conduct reconnaissance and analyze massive volumes of data without triggering security alerts.

Script Kiddies Evolving Into Sophisticated Infrastructure Attackers

The research reveals AI's potential to transform script kiddies into more capable threat actors. "One thing that we've relied on for years is security by obscurity when it comes to utilities," Swick noted. "The knowledge needed to do some of that stuff is getting less likely to be necessary"1

1

.

While Shaver cautioned against overstating the immediate threat—"I will fly my Mandiant flag for a second and try to steer away from the fear, uncertainty, and death of the world is coming to an end, and every script kiddie is now a very sophisticated nation-state adversary"—he acknowledged the trajectory: "But I'm not going to say the potential is not there, because the tools are improving such that the access to information is so much quicker"1

1

.

Thomas emphasized the defensive implications: "If a better-than-average script kiddie can now perform attacks, you have more threat actors out there. There's an acceleration in timeline, more attacks could be happening, and from a defensive position, you might not know who your threat actor is anymore"1

1

.

Small Utilities Face Growing Cybersecurity Vulnerabilities

Small utilities represent a particularly vulnerable target in the expanding threat landscape. The Littleton, Massachusetts public utility breach by Volt Typhoon, a Chinese government-backed group, illustrates these cybersecurity vulnerabilities. Nick Lawler, general manager of the utility serving approximately 15,000 people, initially dismissed the FBI's November 2023 warning call as a scam3

3

.

The hackers exploited an unpatched firewall vulnerability in a FortiGate device that Fortinet had fixed in December 2022, but the outside company managing the utility's systems never installed the update. They remained inside for approximately 10 months before detection3

3

. Lawler couldn't understand why nation-state actors would target such a small operation: "We don't own transmission. We're a distribution company. Yes, we're part of the overall grid, but the impact of taking out Littleton is small"3

3

.

Larger grid operators have implemented stronger defenses following Ukraine's 2015 blackouts, which affected approximately 225,000 customers. The North American Electric Reliability Corporation (NERC) now requires electronic security perimeters around critical equipment, multi-factor authentication, and encrypted connections3

3

. In June 2025, federal regulators approved rules requiring grid operators to monitor traffic between control computers, addressing gaps that allowed Volt Typhoon to move undetected using legitimate employee accounts3

3

.

However, most town utilities fall outside these stringent security rules, creating persistent weak points in the broader infrastructure3

3

. Many operators face staffing and budget constraints, and testing or upgrading systems risks disrupting essential services they cannot afford to interrupt2

2

.

Human Judgment Remains Essential Despite AI Capabilities

Despite concerning success rates, the Frenos research identified important limitations in AI models planning cyberattacks. The strongest three frontier models showed inconsistency, with only 60%, 62.9%, and 74.3% of attack plans passing every repeat test1

1

. "A plan can look sensible and still leave out something essential," the report noted. "The models had information about the task, but some answers skipped a step or assumed access that the plan had not established"1

1

.

Thomas emphasized this limitation: "We're seeing that even though AI models help us accelerate our tooling, accelerate our access and knowledge transfer, they are still prone to hallucinations—aka mistakes. We still think human judgment remains essential for these AI models to make the threat actors achieve whatever mission or goal they're trying to achieve"1

1

.

However, Thomas warned that the research used a relatively simple setup, and "a more capable harness could have given these AI models more of an edge"2

2

. More sophisticated tools providing additional context and feedback could significantly improve AI performance in hacking power and water systems.

Several initiatives from the White House, frontier AI companies, and cybersecurity organizations have emerged in recent weeks to provide resources and lower costs for critical infrastructure organizations facing these evolving threats2

2

. Watch for increased coordination between government agencies, private sector cybersecurity firms, and utility operators as they race to strengthen defenses against AI-enhanced threats targeting industrial systems and nation-state actors leveraging these capabilities against cybercriminals and other adversaries.