Threat reportThreat IntelligenceTL-2026-4445
Frenos Report: Frontier AI Models Can Produce Workable Attack Plans Against Critical Infrastructure / ICS
Frenos Report (TL-2026-4445), also tracked as Frenos AI OT Attack Planning Study, is a medium-severity tracked intrusion set, first published 2026-10-26. It has no confirmed attribution, affects Multiple Industrial control systems / OT environments (power, water, maps to 7 MITRE ATT&CK techniques (T1021, T1046, T1078.001), and is covered by 9 detection rules and 7 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 0None referenced
- Techniques
- 7MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 7Indicators of compromise
Key facts for TL-2026-4445
- Threat ID
- TL-2026-4445
- Also known as
- Frenos AI OT Attack Planning Study
- Severity
- MEDIUM
- Status
- MONITORING
- Category
- THREAT_INTEL
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- energy, water, manufacturing, critical-infrastructure
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 7
How Frenos Report works
Frenos ran 16,980 tests (Oct 2025 - Sept 2026) of 10 AI models on decision, planning and simulated-attack tasks against industrial systems; the top three frontier models produced workable attack plans in roughly 90% of planning attempts. This is a research finding on AI capability uplift; no CVE, named threat actor, malware or in-the-wild campaign is disclosed in the study.
Frenos, an AI pentesting firm focused on operational technology (OT) environments, evaluated how far AI models can help someone plan an attack on industrial systems such as power grids, water systems and manufacturing plants. Between October 2025 and September 2026 it ran 16,980 tests: 13,884 decision attempts (choosing one action), 2,520 planning attempts (planning the steps to a goal) and 576 simulated attacks (working through a simulated scenario). Ten models were tested: six frontier models, two US open-weight models and two foreign open-weight models. Model names and providers were not disclosed in the press coverage.
Results varied widely. Decision-task success ranged from 6% to 47% depending on model. The three strongest frontier models produced workable plans in roughly 90% of planning attempts, but repeatability was weaker: 60%, 62.9% and 74.3% of those plans passed repeat tests. Overall success across task types was 36.2% for the strongest foreign open-weight model, 31.9%, 18.8% and 17.9% for three US frontier models, and 5.2% for the strongest US open-weight model. Failures were typically hallucination-type errors: plans that looked sensible but omitted an essential step or assumed access that had not been established.
Interpretation from quoted practitioners is that AI lowers the knowledge barrier rather than creating new exploits: Frenos CTO Harry Thomas said a better-than-average script kiddie able to run attacks means more threat actors, while also noting human judgment remains essential; Armadin's Paul Shaver noted a model can parse an automation-controller manual quickly and propose ways to exploit it; former AEP CISO Steve Swick described a fast-moving clock. Separately reported context (not part of the Frenos study): Booz Allen reported that frontier AI models completed all eight attack goals in its Chantilly, Virginia ICS testbed, mostly using device protocols and default passwords, compressing days of specialist work into one run; Dragos documented a Dec 2025 - Feb 2026 intrusion at a Monterrey, Mexico water utility in which commercial AI tools were used operationally by an adversary. Recommended defensive themes from the coverage are layered defense, network segmentation, limiting remote access, restricting user permissions, and testing recovery and business-continuity/disaster-recovery plans. Severity MEDIUM is an analyst judgment: no active exploitation, PoC or CVSS applies to the Frenos finding itself.
MITRE ATT&CK techniques used in TL-2026-4445
Lateral Movement
Discovery
T1046 Network Service Discovery
Defense Evasion
T1078.001 Valid Accounts: Default Accounts
Credential Access
T1110.003 Brute Force: Password Spraying
Resource Development
T1588.007 Obtain Capabilities: Artificial Intelligence
Reconnaissance
T1590 Gather Victim Network Information; T1592 Gather Victim Host Information
Affected products and versions in Frenos Report
- Multiple — Industrial control systems / OT environments (power, water, manufacturing)
Remediation for Frenos Report
Immediate actions
- Inventory and restrict remote access paths into OT/ICS networks
- Change default credentials on controllers, HMIs and industrial gateways
- Verify IT/OT network segmentation and block unneeded cross-zone traffic
Workarounds
- Limit internet exposure of controller management and SCADA/IIoT interfaces
- Alert on password-spray and unusual enumeration against OT-facing interfaces
Longer-term hardening
- Adopt layered defense for OT environments with monitoring at segment boundaries
- Apply least-privilege to user and service permissions in industrial networks
- Test recovery procedures and exercise business-continuity and disaster-recovery plans
- Use AI-assisted adversary emulation in OT to validate controls before attackers do
Timeline of Frenos Report
- Frenos begins its October 2025 - September 2026 testing of AI models on decision, planning and simulated-attack tasks against industrial systems (exact start day not stated; October 2025).
- Related context, not part of the Frenos study: Dragos later reports an AI-assisted intrusion against a Monterrey, Mexico water utility spanning December 2025 to February 2026 (exact start day not stated).
- Related context: Dragos publicly reports commercial AI tools (Claude and GPT models) used operationally during the Monterrey water-utility intrusion, attributed to a group tracked as Bauxite Limeade.
- Frenos testing window closes (September 2026) after 16,980 tests: 13,884 decision, 2,520 planning and 576 simulated-attack runs across 10 models.
- The Register publishes coverage of the Frenos report: top three frontier models produce workable attack plans in ~90% of planning attempts.
- Frenos report publication date as stated on the Register article page; findings include 60%, 62.9% and 74.3% repeat-test pass rates for the top three models.
Sources cited for Frenos Report
- AI has 'potential' to turn script kiddies into sophisticated infrastructure attackers
- AI models show 90% success rate planning cyberattacks on critical infrastructure
- Frontier AI cleared every OT attack goal Booz Allen set in its lab
- (TLP:CLEAR) AI-Assisted Water Utility Intrusion Underscores Growing OT Exposure Risk
- Anthropic's Claude Helped Adversary Map OT Path During Mexican Water Utility Breach
- OpenAI and Anthropic LLMs Used in Critical Infrastructure Cyber-Attack, Warns Dragos
- AI-Assisted Cyberattack Targets Mexican Water Utility (OECD AI Incidents)
Detection coverage for TL-2026-4445
As of 2026-10-26, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4445 across Splunk SPL, Microsoft KQL and Sigma, covering 7 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.