Cybersecurity News Today: AI Models Plan Attacks on Water and Power Systems at About 90%
The most consequential story in cybersecurity news today is not a new exploit. It is a measurement. On October 21, 2026, cybersecurity firm Frenos published a year-long study of how well today's AI models can help plan attacks against industrial control systems, the computers that run water treatment plants, electrical distribution networks and factories. The headline result: the three strongest commercial models produced workable attack plans in about 90 percent of planning attempts. The caveats matter as much as the number, and they are stated in full below. If you operate a small utility, a plant, or any control network, the exposure check further down takes about a minute.
Honest scope, read this first: The 90 percent figure is planning with supplied intel, in simulation. In every test, Frenos gave the model background information about the target, its assets, its networks, its known weaknesses and the access each action required, plus a set of attack actions to choose from. No real infrastructure was attacked, and the plans were not flawless: models sometimes skipped an essential step or assumed access the plan had not established. Frenos states plainly that the research did not demonstrate AI independently identifying targets or executing attacks without human direction. What the study does show is narrower and still serious: the planning step, the part that used to require a skilled specialist, is now something a low-skill attacker with access or intel can largely rent from a commercial AI service.
The study, exactly as published
Scale:16,980 tests run between October 2025 and September 2026, made up of 13,884 decision attempts, 2,520 planning attempts and 576 simulated attacks.
Models: 10 in total, six frontier models, two US open-weight models and two foreign open-weight models. Frenos does not name the models or providers.
Planning result: the three strongest frontier models produced workable attack plans in 89.5 to 92.9 percent of planning attempts.
Consistency: those same models were not reliable repeat performers. Only 60, 62.9 and 74.3 percent of their plans passed every repeat of the test.
Single decisions: on individual decision attempts, pass rates ranged from 6 to 47 percent depending on the model.
Overall results: the best foreign open-weight model reached 36.2 percent overall. Three other US frontier models scored 31.9, 18.8 and 17.9 percent. The best US open-weight model managed 5.2 percent.
16,980tests Frenos ran between October 2025 and September 2026
~90%planning success for the top three frontier models (89.5 to 92.9 percent)
576simulated attacks inside the test program
10AI models tested; Frenos names none of them
Read the spread, not just the peak. The gap between the best frontier models and everything else is wide, and even the best models produced plans that skipped steps or assumed access they had not earned. But the direction is the story: a task that once filtered out almost everyone except specialists now succeeds most of the time, on the first planning attempt, for the strongest commercial systems anyone can subscribe to.
Why this cybersecurity news today matters: the skill barrier is what fell
The Register summarized the implication in one line: AI has the potential to turn script kiddies into sophisticated infrastructure attackers. The mechanism is patience as much as knowledge. Frenos co-founder and CTO Harry Thomas said AI could help an attacker who gains access to an industrial network quietly map systems and identify weaknesses, without the time constraints that limit a human intruder. Steve Swick, a former senior security executive at American Electric Power, described the pace of change as "a clock that is moving faster than we've ever seen."
That framing fits the small operator's reality. A municipal water utility or a small manufacturer does not employ a threat-modeling team, and cannot out-plan an AI. What it can do is decide what is reachable. Every control in the checklist below is about exposure and segmentation: how much of the control network an attacker can touch, from where, with what credentials. An AI-planned attack still needs a path in, a screen it can reach, and credentials that work. Small operators control all three of those, today, with ordinary network work.
Run the check: how exposed is your control network?
Answer for the network that runs your plant, pumps, substation or line. Everything runs in your browser; nothing is sent anywhere. If you do not know an answer, pick "Not sure." An unknown is itself a finding.
Close the gaps, in the order that matters
Segment the networks: the control network and the office network should not be one flat network. Separate them, and let traffic cross only through firewall rules that name the hosts and ports allowed. One phished office inbox should never be one hop from a controller.
Kill direct internet reachability: no HMI, SCADA screen or engineering workstation should answer from the public internet. If a screen is reachable today, that is the first fix, ahead of everything else on this list.
One door for remote access: vendor and staff access should enter through a single jump host with multi-factor authentication and named accounts. Shared VPN accounts and exposed remote desktop are how quiet access becomes permanent access.
Change every default password: controllers, HMIs, cameras and network gear ship with vendor defaults that are published in manuals. Anything still on a default is an open credential for a plan that already knows to try it.
Know what is on the network: keep a basic inventory of control network devices and alert on unknown ones. The Frenos finding is about planning speed; an inventory and an alert are what turn a quiet mapping exercise into a detected event.
BreachHunter, Ingenious AI's external exposure hunter, exists for the question this study raises: not whether an attacker can plan, but what of yours they can reach while planning. It hunts the internet-facing services, forgotten remote access paths and exposed panels that turn a plan into an incident. Get early access on WhatsApp.
FROM INGENIOUS AI
BreachHunter is built for exactly this: finding the control screens, remote access paths and services your network exposes, before someone else finds them.
4. How did the best US open-weight model do overall?
5. A small water plant runs one flat network and an HMI reachable from the internet. What is the first move?
Frequently asked questions
What is the Frenos ICS study, in plain terms?
The Frenos ICS study is a year-long test by cybersecurity firm Frenos of how well AI models can help plan attacks on industrial control systems, the computers that run water treatment, power distribution and factories. Across 16,980 tests, the three strongest commercial models produced workable attack plans in about 90 percent of planning attempts.
Did the AI models hack real power or water systems?
No. Every test ran in a simulated environment, and Frenos handed each model background information about the target: its assets, networks, known weaknesses and the access each action required. Frenos states plainly that the research did not show AI finding targets on its own or carrying out attacks without human direction.
Which models did best, and which did worst?
The three strongest frontier models produced workable plans in 89.5 to 92.9 percent of planning attempts, but only 60 to 74.3 percent of their plans passed every repeat. The best foreign open-weight model reached 36.2 percent overall. The best US open-weight model managed 5.2 percent. Frenos does not name any of the models.
Why does this matter if the AI needed the answers handed to it?
Because attackers often get that intel another way: a phishing login, a vendor account, a scan, or a foothold inside the network. Frenos CTO Harry Thomas notes that once inside, an attacker can let AI map systems and find weaknesses without human time limits. The study shows the planning step no longer filters out low-skill attackers.
What should a small water or power operator do first?
Start with exposure, not software. Separate the control network from the office network, make sure no control screen is reachable from the internet, route every remote login through one jump host with multi-factor authentication, and change every default password on control devices. Those four steps cut the access an AI-planned attack needs to work.
Sources: Frenos research report, published October 21, 2026 (test design, the 16,980 test counts, the planning success rates, the consistency figures, and the supplied-intel and simulation caveats) · Axios, October 21, 2026 (original reporting on the Frenos study) · The Register, October 21, 2026 (the Harry Thomas and Steve Swick quotes and the script-kiddie framing) · Yeni Safak, October 22, 2026 (the 89.5 to 92.9 percent planning range and the open-weight results).
Related checks
Linux KSMBD RCE Check: two CVSS 9.0 flaws in the Linux kernel's SMB server, disclosed before any fix existed
SafePay Ransomware Check: the joint advisory on the SafePay gang, 600+ organizations hit since August 2024