Frontier AI models capable of Blueprinting attacks on critical infrastructure

New research from cybersecurity firm Frenos finds advanced AI can construct attack plans for power and water systems at alarming success rates

By LineZotpaper

Published21 October 2026

Read Time2 min

Major AI models are increasingly capable of planning cyberattacks on critical infrastructure such as power grids and water treatment plants, according to new research from cybersecurity company Frenos. In a series of nearly 17,000 tests, three of the 10 models tested successfully constructed attack plans in roughly 90 percent of attempts, while top-tier frontier models succeeded between 17.9 and 31.9 percent of the time. Former American Electric Power security executive Steve Swick described the pace of advancement as a clock moving faster than ever seen, underscoring the urgency for defenders.

The research by Frenos tested 10 AI models on their ability to plan attacks against industrial control systems, such as the software that monitors water treatment processes. The study included 2,520 dedicated attempts to construct complete attack plans. The models were provided with information about potential targets and asked to determine the steps required to achieve specific objectives.

Frenos did not disclose the specific names of the models tested. The performance varied widely. The strongest foreign open-weight model succeeded in 36.2 percent of attempts, while the strongest United States open-weight model achieved a success rate of only 5.2 percent.

Critical infrastructure systems have long been prime targets for nation-state adversaries and cybercriminals. Operators face persistent staffing and budget constraints. Unlike traditional corporate networks, industrial systems can be sensitive to unexpected traffic and commands, meaning even a failed attack attempt could disrupt essential services. This makes testing and upgrading systems a delicate balancing act.

Frenos co-founder and CTO Harry Thomas highlighted that AI does not suffer from the limitations of human hackers. "AI doesn't have the problem with patience," Thomas said. "It doesn't need to eat. It doesn't need to sleep, and it doesn't need to use the restroom." Paul Shaver, head of operational technology at cybersecurity firm Armadin, noted that AI agents can already conduct reconnaissance and analyze large volumes of data without necessarily triggering security alerts.

Thomas added that the setup used in the study was relatively simple. More sophisticated tools with additional context and feedback loops could further improve AI performance. In response to these rising threats, several initiatives from the White House, frontier AI companies, and cybersecurity organizations have emerged in recent weeks to provide resources and lower the costs of protecting critical infrastructure.

Analysis

Why This Matters

Critical infrastructure such as water and power has few alternatives and is expensive to secure. AI is lowering the skill barrier for orchestrating complex attacks, widening the pool of potential adversaries.
The rapid pace of AI advancement may outstrip the slow, safety-conscious upgrade cycles of industrial control systems.
Successful attacks could cause physical damage, service disruptions, or public health hazards, moving beyond data theft to real-world consequences.

Background

Critical infrastructure such as water systems and manufacturing plants have long been targeted by nation-state adversaries and cybercriminals. Many operators face staffing and budget constraints. Unlike corporate networks, industrial control systems are sensitive to unexpected traffic and commands, meaning even an unsuccessful attack could disrupt essential operations. This makes testing and upgrading systems both risky and necessary.

Key Perspectives

Security Researchers (Frenos): The threat is urgent and accelerating. AI's patience and ability to operate without triggering conventional detection tools gives attackers a powerful new capability. The models tested represent only the current frontier and performance could improve with more sophisticated tools. Critical Infrastructure Operators: Face a difficult trade-off between security upgrades and the risk of disrupting essential services. Staffing and budget constraints are significant hurdles to improving defenses. Policymakers and Defenders: The results underscore the need for responsible AI deployment, robust model evaluations, and direct support for infrastructure defenders. Recent initiatives from the White House and industry signal growing awareness of the challenge.

What to Watch

Whether future studies show success rates climbing toward 100 percent as models and supporting tools improve.
The specific impact of new White House and industry initiatives designed to provide resources for critical infrastructure protection.
Whether the performance gap between closed frontier models and open-weight models narrows, potentially broadening access to these capabilities.

Sources

AI is getting better at hacking power and water systems, new research shows · Axios

Checked

12 claims in this story checked against 1 source: 8 supported.

Show each claim

SupportedFrontier AI models can blueprint attacks on critical infrastructure.Axios: “The world's most advanced AI models are suddenly capable of blueprinting cyberttacks on critical services like power grids and water systems with alarming success rates”
SupportedFrenos research finds advanced AI can construct attack plans for power and water systems at alarming success rates.Axios: “Top-tier frontier models are dangerously adept at mapping out attacks, new research from cybersecurity company Frenos shows”
SupportedThree of the 10 models constructed attack plans in roughly 90% of attempts.Axios: “Three out of 10 models tested successfully constructed attack plans in roughly 90% of attempts.”
SupportedFrontier models succeeded in 17.9% to 31.9% of attempts.Axios: “Three models the researchers considered to be at the frontier of capabilities succeeded in just 17.9% to 31.9% of attempts.”
SupportedFormer American Electric Power security executive Steve Swick said the pace was like a clock moving faster than ever seen.Axios: ““It's a clock that is moving faster than we've ever seen,” Steve Swick, former top security executive at American Electric Power, told reporters during a briefing.”
SupportedFrenos’s research included nearly 17,000 tests and 2,520 attempts to construct complete attack plans.Axios: “The research included nearly 17,000 tests, including 2,520 attempts to construct complete attack plans.”
SupportedThe strongest foreign open-weight model succeeded 36.2% of the time, while the strongest U.S. open-weight model succeeded 5.2%.Axios: “The strongest foreign open-weight model succeeded 36.2% of the time, while the strongest U.S. open-weight model succeeded just 5.2%.”
Partly supportedThe study tested models on attacks against industrial control systems.Axios: “Researchers at Frenos tested 10 AI models on their ability to plan attacks against industrial systems, such as the software that monitors water treatment processes.”
SupportedHarry Thomas said, “AI doesn't have the problem with patience,” and that it does not need to eat, sleep or use the restroom.Axios: ““AI doesn't have the problem with patience,” Thomas said. “It doesn't need to eat. It doesn't need to sleep, and it doesn't need to use the restroom.””
Partly supportedAI does not suffer from the limitations of human hackers.Axios: “AI could help them quietly map out systems and identify weaknesses without the same time constraints facing human hackers, Frenos co-founder and CTO Harry Thomas said.”
Partly supportedCritical infrastructure systems have long been prime targets for nation-state adversaries and cybercriminals.Axios: “Critical services like water systems and manufacturing plants have long been targets for nation-state adversaries and cybercriminals.”
Not in the sourcesRecent initiatives from the White House, frontier AI companies and cybersecurity organizations emerged in response to rising threats.Axios: “Several initiatives — including from the White House, frontier AI companies, and cybersecurity organizations — have cropped up in recent weeks to help lower the costs and provide resources for critical infrastructure organizations.”

Correction

21 October 2026An earlier version of this story attributed a roughly 90 percent success rate to the most capable models. That rate applied to three of the 10 models tested, while the models considered frontier models succeeded in 17.9 to 31.9 percent of attempts.