Top AI models successfully plan cyberattacks on water, power systems in 90% of attempts: Study

Some of the world's most advanced artificial intelligence models successfully developed cyberattack plans targeting critical infrastructure, including water and power systems, in roughly 90% of attempts, according to research published Wednesday.

Cybersecurity company Frenos tested 10 AI models on their ability to identify weaknesses, assess access requirements and plan attacks against industrial systems that operate essential services.

The study involved 16,980 tests, including 13,884 individual decisions, 2,520 attempts to develop complete attack plans and 576 simulated runs.

Three leading commercial AI models produced workable attack plans in 89.5% to 92.9% of planning attempts, while other models performed significantly worse.

The strongest foreign open-weight model achieved a 36.2% success rate, compared with 5.2% for the best-performing US open-weight model. The researchers did not disclose the models' names.

Frenos emphasized, however, that the tests used supplied information and simulated scenarios rather than real-world attacks.

The models sometimes omitted critical steps or assumed access they did not possess, and the research did not demonstrate that AI could independently identify targets or carry out cyberattacks.

The findings come amid growing concerns about attacks on industrial systems, including a recent incident in France in which hackers manipulated refrigeration systems at hundreds of supermarkets, causing temperatures to rise sharply, spoiling food and reportedly triggering fires.

Frenos also cited a January cyberattack on a Mexican water utility, where attackers used Anthropic's Claude AI to identify an industrial monitoring interface and suggest additional access attempts. Those attempts failed, and no compromise of operational control systems was confirmed.

The company urged critical infrastructure operators to strengthen network separation, restrict remote access and monitor suspicious activity to reduce the risk of AI-assisted attacks.