Artificial intelligence (AI) agents can hack into wind farms, erase the memory of electronic controllers and cut off their electricity production capability in under two hours.
Research to be unveiled next week gives new urgency to calls for organisations to properly secure the networks used to manage critical physical infrastructure.
The warning follows a wave of attacks on refrigeration systems used by retailers across Europe, meat processors in the UK and a French blood bank.
According to “red team” reports from penetration testing company Shinobi Security, two off-the-shelf large language models (LLMs) were able to stop six turbines delivering nearly 10MW (megawatts) of power in a replicated wind farm, starting with “nothing but a set of VPN credentials”.
No specialist knowledge needed
The company’s head of research, David Mound, told Computer Weekly that the experiment shows that hackers no longer need specialist knowledge to attack devices used to control physical infrastructure – known as operational technology (OT).
He said the research showed that attackers could use an LLM to launch a successful attack without having detailed knowledge of how wind farms work.
“Even if you are not a seasoned OT red teamer or penetration tester, a normal attacker is able to amplify their capability by using and exploiting large language models. Even LLMs on their own are more than capable of penetrating and exploiting these environments,” he said.
Mound built a test rig from the same components used in a wind farm that was attacked by suspected Russian hackers in Poland in December 2025.
Poland’s Computer Emergency Response Team (CERT) published a detailed report on the incident, allowing Mound and his co-researchers to build a rig that mimicked the operation of a real wind farm.
The rig used the same networking devices and a Siemens controller to replicate the farm’s connection to the electricity grid. It was combined with simulations of Scada (supervisory control and data acquisition) and HMI (human-machine interface) controllers to mimic the operation of the wind turbines.
Moonshot and Claude
Mound said it was important to make the rig as true to life as possible to ensure that the AI agents believed they were acting in a real environment, as the experiment showed they would behave differently if they believed the test was a simulation.
The researchers tested Anthropic’s Claude LLM, along with Kimi, an open source, open-weight AI model supplied by Chinese AI startup Moonshot.
Both models were able to successfully shut down the wind farm in a fraction of the time taken by human attackers targeting similar plants in Poland.
Claude took 66 minutes to shut down the wind farm’s connection to the power grid, at a cost of $20 in tokens. Kimi took just under two hours to reach the same point at a cost of just $8.
“In the real Polish wind farm hack, the attackers were there for 11 days before they shut down the plant,” said Mound.
Misconfigured devices
The AI models followed a similar attack path to the real hack in Poland, exploiting misconfigured devices rather than attempting anything more sophisticated, such as hunting for zero-day vulnerabilities.
They were given credentials to access a VPN – information that could be found on the dark web – to make the initial access to the wind farm.
The models worked out how to access a control device with a web portal that had been set up with default credentials, and from there they were able to set up an encrypted tunnel and pivot into the rest of the network.
The AI systems worked out that the network contained an “historian” database, which, among other operational data, recorded the actions taken by controllers in response to different wind speeds over time.
“The speed and efficiency that the LLMs work at is a big concern. Domain-specific knowledge is no longer a barrier to entry for attacking these types of environments. Understanding that you are under attack within an hour is going to be very difficult”
David Mound, Shinobi Security
For the purpose of the experiment, the models were told not to do anything that would physically damage the infrastructure so that the experiment could be repeated.
“They were absolutely capable of turning off the power. And if it was a case of taking further malicious actions or deleting programs from the programmable logic controllers, they would have been more than capable of doing that themselves,” he said.
In a real-life attack, the LLMs could have been used by attackers to install ransomware on the control devices used in the wind farm, effectively shutting it down until the ransom was paid or until the wind farm could restore its systems from backups.
The turbine blades would have been protected from physical damage, as there are safety mechanisms in place to prevent them from spinning too quickly.
AI agent spoofed weather data
In an unexpected twist, one of the AI agents worked out how to spoof data from the weather station to make it appear that the wind was gusting, causing safety circuits to automatically shut down the turbines.
“It is incredible for an LLM to come up with that method of stopping the power because the main goal was to stop the power being placed on the grid,” he said.
One model also threatened to “drop the safety theatre” and take further destructive action if the researchers confirmed its hunch that the wind farm rig was a simulation, rather than a real wind farm.
When the Polish wind farm was attacked in December 2025, operators became aware that the plant had been attacked before there was a major incident. But a similar AI-driven attack would leave them with less time to react.
“The speed and efficiency that the LLMs work at is a big concern. Domain-specific knowledge is no longer a barrier to entry for attacking these types of environments,” said Mound. “Understanding that you are under attack within an hour is going to be very difficult.”
Getting basic security right
Protecting wind farms is a matter of getting the basics right, ensuring that network devices are not misconfigured and are not set to default passwords, said Mound.
It is also clear that information not generally regarded as sensitive for security purposes, such as records in the historian database, can be extremely useful for an LLM attacker. For example, it can use the information to work out that it has accessed a wind farm and how the wind farm operates.
“Those areas within a network where you have knowledge stores that you might not have thought had high value before now have much greater value when it comes to delivering context to an LLM,” he said.
Last week, Richard Horne, chief executive officer of the National Cyber Security Centre (NCSC), urged organisations to ensure that control devices were patched and updated, in the wake of the hacking attacks on supermarket fridges.
“Large businesses will have a large amount of operational technology, whether it’s manufacturing lines, heating controls, or building management systems,” he said. “All organisations need to be looking for them and addressing both the connectivity and the configuration of those devices.”
David Mound will be presenting his research at the Sans CyberThreat Summit on 16 November.
