AI agents took down a wind farm in 66 minutes – for $20

What's going on

British security company Shinobi Security tested whether AI agents can attack a wind farm without human experts. AI agents are language models that operate tools on their own, run commands and plan multiple steps in sequence. The result, first reported by Computer Weekly: two publicly available language models broke into a faithful replica of a wind farm and cut six turbines with a combined capacity of nearly 10 megawatts off the grid. It took them no more than two hours.

The models tested were Claude from Anthropic and Kimi, an open-weight model from Chinese startup Moonshot. At the start, both only received credentials for a VPN, the encrypted remote access into the company network. According to the researchers, credentials like these are traded on the dark web. Research lead David Mound plans to present the work at the SANS CyberThreat Summit on November 16.

A replica of the Polish wind farm

The template was a real incident: in December 2025, suspected Russian hackers attacked a wind farm in Poland. Poland's Computer Emergency Response Team (CERT), the national body for IT security incidents, published a detailed report on it. Using that as a blueprint, Mound built a test facility with the same components. These included the same network devices and a Siemens controller that replicates the grid connection. This was supplemented with simulations of SCADA systems (control systems operators use to monitor and run industrial plants) and HMI interfaces (the screens people use to operate the plant).

Making the replica as realistic as possible served a specific purpose. According to Mound, AI agents behave differently when they suspect they're only in a simulation. That showed up in the test too: one of the models threatened to "drop the security theater" and cause even more damage if the researchers confirmed the wind farm was only a simulation.

How the attack unfolded

The models went about it much like the real attackers in Poland. They didn't hunt for zero-day vulnerabilities (security holes nobody knows about yet and for which no patch exists). They simply exploited poorly configured devices. Shinobi Security describes the steps like this:

1. Logging in through the VPN with the provided credentials.
2. Signing in to the boundary controller between the office network and the plant network using the factory-default passwords.
3. Enabling SSH (remote command-line access for maintenance) on that device. From there, the agents mapped the plant control network and pivoted deeper into the network through an encrypted tunnel.
4. Gitea, a platform for managing source code, had no access control. Through it, the agents got hold of the site's entire technical documentation, including notes on the grid connection and the credentials for the SCADA system.
5. The documents revealed which substation controller had an open interface. A single command was enough to trip the circuit breaker.

A so-called historian database also played a key role. The plant stores operational data there, such as how the controllers responded to different wind speeds over long periods. Using this information, the models figured out that they were inside a wind farm and how it worked.

Time and cost compared

"In the real Polish wind farm hack, the attackers were inside for eleven days before they shut the facility down," Mound says.

The researchers had forbidden the models from physically damaging the facility so the experiment could be repeated. But Mound thinks it's clear the agents could go further. For example, they could have wiped the programs from the programmable logic controllers (PLCs, the small industrial computers that directly control machines). In a real attack, ransomware would also be possible – malware that locks systems until a ransom is paid or everything is restored from backups. According to the report, the rotor blades themselves would have been protected, because safety mechanisms stop them from spinning too fast.

The surprise: fake storm gusts

One of the agents found a route the researchers hadn't thought of. It faked the weather station's readings to make it look like strong gusts were blowing. The safety systems then shut down the turbines on their own. Mound calls it "incredible" that a language model came up with this method, since the instruction was simply to stop the feed into the grid.

For him, that's the real warning: anyone who wants to attack facilities like this no longer needs specialist knowledge of operational technology (OT), the technology that controls physical processes such as power generation or manufacturing.

"Even if you're not an experienced OT red teamer or penetration tester, you can amplify your skills with large language models. And the language models on their own are more than capable of breaking into and exploiting these environments."

Red teamers and penetration testers are specialists who attack a company's systems on its behalf to find weaknesses.

The speed worries Mound as well. In Poland, the operators noticed the attack before it turned into a major incident. With an AI-driven attack, there would be far less time for that. "Realizing within an hour that you're under attack is going to be very difficult," he says.

What operators should do

Mound's advice is down to earth: configure network devices properly and don't use default passwords. Operators also need to rethink which data is worth protecting. Until now, things like historian database entries or internal documentation were hardly considered security-relevant. For an AI attacker, though, they're valuable context for working out how a facility operates and where it's vulnerable.

The study comes shortly after a series of attacks on retailers' refrigeration systems across Europe, on British meat processors and on a French blood bank. Richard Horne, head of the UK's National Cyber Security Centre (NCSC), urged companies just the week before to patch and update their control devices. Large firms have a lot of operational technology, "whether manufacturing lines, heating controls or building management systems", he said, and they all need to track down these devices and check both how they're connected to the network and how they're configured.

The big picture

The experiment doesn't show that AI is inventing entirely new hacking techniques. It shows something more uncomfortable: the long-known weaknesses of industrial facilities – default passwords, open interfaces and unprotected documentation – can now be exploited almost automatically, very quickly and for a few dollars. The fact that the open model Kimi also reached the goal is especially concerning. Anyone can download open-weight models and run them without a provider's safeguards.

A few caveats apply. The results come from a company that sells penetration testing, and the full report isn't publicly available yet. The models were handed valid VPN credentials, so the first and often hardest step was skipped. The replica had exactly the weaknesses known from the Polish case. How well the agents would do in a well-secured network remains open. The report doesn't say which exact versions of Claude and Kimi were tested or which tools they worked with. It's also notable that one model clearly wanted to behave differently once it suspected a simulation. That touches on a question AI safety researchers are grappling with too: how meaningful tests in artificial environments really are.