# Frenos Report: Frontier AI Models Can Produce Workable Attack Plans Against Critical Infrastructure / ICS

> Frenos ran 16,980 tests (Oct 2025 - Sept 2026) of 10 AI models on decision, planning and simulated-attack tasks against industrial systems; the top three frontier models produced workable attack plans in roughly 90% of planning attempts. This is a research finding on AI capability uplift; no CVE, named threat actor, malware or in-the-wild campaign is disclosed in the study.

- **Published:** 2026-10-26T10:20:16Z
- **Last reviewed:** 2026-10-26T10:20:16Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4445
- **ID:** TL-2026-4445
- **Severity:** MEDIUM
- **Category:** THREAT_INTEL
- **Status:** MONITORING
- **Detections:** 9 · **IOCs:** 7 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Frenos, an AI pentesting firm focused on operational technology (OT) environments, evaluated how far AI models can help someone plan an attack on industrial systems such as power grids, water systems and manufacturing plants. Between October 2025 and September 2026 it ran 16,980 tests: 13,884 decision attempts (choosing one action), 2,520 planning attempts (planning the steps to a goal) and 576 simulated attacks (working through a simulated scenario). Ten models were tested: six frontier models, two US open-weight models and two foreign open-weight models. Model names and providers were not disclosed in the press coverage.

Results varied widely. Decision-task success ranged from 6% to 47% depending on model. The three strongest frontier models produced workable plans in roughly 90% of planning attempts, but repeatability was weaker: 60%, 62.9% and 74.3% of those plans passed repeat tests. Overall success across task types was 36.2% for the strongest foreign open-weight model, 31.9%, 18.8% and 17.9% for three US frontier models, and 5.2% for the strongest US open-weight model. Failures were typically hallucination-type errors: plans that looked sensible but omitted an essential step or assumed access that had not been established.

Interpretation from quoted practitioners is that AI lowers the knowledge barrier rather than creating new exploits: Frenos CTO Harry Thomas said a better-than-average script kiddie able to run attacks means more threat actors, while also noting human judgment remains essential; Armadin's Paul Shaver noted a model can parse an automation-controller manual quickly and propose ways to exploit it; former AEP CISO Steve Swick described a fast-moving clock. Separately reported context (not part of the Frenos study): Booz Allen reported that frontier AI models completed all eight attack goals in its Chantilly, Virginia ICS testbed, mostly using device protocols and default passwords, compressing days of specialist work into one run; Dragos documented a Dec 2025 - Feb 2026 intrusion at a Monterrey, Mexico water utility in which commercial AI tools were used operationally by an adversary. Recommended defensive themes from the coverage are layered defense, network segmentation, limiting remote access, restricting user permissions, and testing recovery and business-continuity/disaster-recovery plans. Severity MEDIUM is an analyst judgment: no active exploitation, PoC or CVSS applies to the Frenos finding itself.

## MITRE ATT&CK

- T1588.007 Obtain Capabilities: Artificial Intelligence
- T1592 Gather Victim Host Information
- T1590 Gather Victim Network Information
- T1046 Network Service Discovery
- T1110.003 Brute Force: Password Spraying
- T1078.001 Valid Accounts: Default Accounts
- T1021 Remote Services

## Sources

- [AI has 'potential' to turn script kiddies into sophisticated infrastructure attackers](https://www.theregister.com/a/5304297)
- [AI models show 90% success rate planning cyberattacks on critical infrastructure](https://theoutpost.ai/news-story/ai-models-show-90-success-rate-planning-cyberattacks-on-critical-infrastructure-32458/)
- [Frontier AI cleared every OT attack goal Booz Allen set in its lab](https://www.helpnetsecurity.com/?p=387525)
- [(TLP:CLEAR) AI-Assisted Water Utility Intrusion Underscores Growing OT Exposure Risk](https://www.waterisac.org/tlpclear-ai-assisted-water-utility-intrusion-underscores-growing-ot-exposure-risk)
- [Anthropic's Claude Helped Adversary Map OT Path During Mexican Water Utility Breach](https://expertinsights.com/news/anthropics-claude-helped-adversary-map-ot-path)
- [OpenAI and Anthropic LLMs Used in Critical Infrastructure Cyber-Attack, Warns Dragos](https://infosecurity-magazine.com/news/llm-critical-infrastructure/)
- [AI-Assisted Cyberattack Targets Mexican Water Utility (OECD AI Incidents)](https://oecd.ai/en/incidents/2026-05-07-11dc)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4445