AI Models Show 90% Success Rate Planning Cyberattacks on Critical Infrastructure

Frontier AI Models Demonstrate Alarming Capability in Planning Infrastructure Attacks

Cybersecurity firm Frenos has published research showing that AI is rapidly advancing the capability to plan cyberattacks on critical infrastructure including power grids and water systems2

2

. Between October 2025 and September 2026, researchers conducted 16,980 tests across 10 AI models, evaluating their ability to construct attack plans targeting industrial systems1

1

. The results reveal that three out of 10 models tested—specifically the strongest frontier AI models—successfully developed workable attack plans in roughly 90% of attempts2

2

.

The testing included 13,884 decision attempts, 2,520 planning attempts, and 576 simulated attacks on industrial systems1

1

. Each model received background information about assets, networks, and known weaknesses before selecting from a set of attack actions. Harry Thomas, chief technology officer and co-founder of Frenos, emphasized that AI doesn't face the same constraints as human hackers: "AI doesn't have the problem with patience. It doesn't need to eat. It doesn't need to sleep, and it doesn't need to use the restroom"2

2

.

Technical Barriers Lowering for Sophisticated Infrastructure Attackers

The research demonstrates how AI is lowering technical barriers that have traditionally protected critical infrastructure through security by obscurity. "One thing that we've relied on for years is security by obscurity when it comes to utilities," said Steve Swick, former chief information security officer at American Electric Power. "The knowledge needed to do some of that stuff is getting less likely to be necessary"1

1

. Paul Shaver, head of operational technology at cybersecurity firm Armadin, explained that AI can "download the manual for almost any automation controller, parse through that very quickly, and come up with ways that I can exploit a dedicated feature of something that was not secure by design"1

1

.

The acceleration is tangible. Shaver noted that with AI assistance, "I'm very quickly building tools in days that would normally have taken me months"1

1

. This timeline compression means that even script kiddies—low-skilled attackers—could potentially evolve into more capable threats as models improve. "It's a clock that is moving faster than we've ever seen," Swick told reporters during a briefing2

2

.

Performance Varies Widely Across Open-Weight Models and Frontier Systems

While the top three frontier models showed exceptional performance, success rates varied dramatically across the tested systems. Depending on the model, between 6% and 47% of single-action choices passed validation1

1

. Among open-weight models, the strongest foreign model achieved a 36.2% overall success rate, outperforming three other US frontier models that scored 31.9%, 18.8%, and 17.9% respectively1

1

. The strongest US open-weight model succeeded just 5.2% of the time2

2

.

Consistency remains a challenge even for high-performing models. The three strongest frontier models showed repeatability rates of 60%, 62.9%, and 74.3%—meaning their attack plans didn't always pass validation on subsequent attempts1

1

. Frenos researchers noted that models sometimes produced plans that "skipped a step or assumed access that the plan had not established"1

1

.

Human Oversight Remains Essential Despite AI Hallucination Risks

Despite the impressive capabilities demonstrated in attacks on industrial systems, AI hallucination and mistakes continue to limit autonomous execution. "We're seeing that even though AI models help us accelerate our tooling, accelerate our access and knowledge transfer, they are still prone to hallucinations—aka mistakes," Thomas said. "We still think human judgment remains essential for these AI models to make the threat actors achieve whatever mission or goal they're trying to achieve"1

1

.

The research used a relatively simple setup to guide models through their tasks. Thomas acknowledged that "a more capable harness could have given these AI models more of an edge" by providing additional context and feedback to improve performance2

2

. This suggests that current results may represent a lower bound on AI capabilities for hacking power and water systems.

Critical Infrastructure Operators Face Mounting Pressure

The implications for critical infrastructure are severe. Many operators of water systems, power grids, and manufacturing plants already face staffing and budget constraints2

2

. Unlike traditional corporate networks, industrial systems can be sensitive to unexpected traffic and commands, meaning even unsuccessful attack attempts could disrupt essential operations2

2

. Shaver noted that AI agents can already conduct reconnaissance and analyze large volumes of data without necessarily triggering security alerts2

2

.

As AI lowers barriers, Thomas warned of a multiplication effect: "If a better-than-average script kiddie can now perform attacks, you have more threat actors out there. There's an acceleration in timeline, more attacks could be happening, and from a defensive position, you might not know who your threat actor is anymore"1

1

. Several initiatives from the White House, frontier AI companies, and cybersecurity organizations have emerged in recent weeks to help lower costs and provide resources for critical infrastructure organizations facing these evolving threats2

2

.