13Cyber & softwareBelow the top 20
Model-assisted attacks on operational technology
CapabilityDomain knowledgeImpact domainBoth
Statement (NASA form)
Given that manuals, ladder logic, and forum posts for ICS are in the pretraining mix, there is a possibility of an attacker using a model as a technician on a plant they have never seen resulting in physical disruption of a utility, factory, or hospital plant.
Likelihood
2Remote
Consequence
5Catastrophic
Urgency
3Priority
The gap between a script kiddie and a process engineer just shrank.
Composite 13 = 2×5 + 3
Applicable mitigations
Controls · Hardened weight storage and insider controls · Mandatory vulnerability-sharing with national CERTs before launch · Staged release with external red-team gates · Siting only where spare water and firm power already exist · Closed-loop cooling as a permit condition · Training load pays its own interconnection and water