An AI agent that can read and write to a factory controller does not automatically know how to break anything. A new study measures exactly where that gap closes.
Researchers behind the PLCBench benchmark (arXiv:2608.26882) built a hardware-in-the-loop test rig using four real commercial PLCs wired to closed-loop process simulations, then let tool-using LLM agents from five model families try to hijack them across 240 episodes. A deterministic evaluator checked each run against six hidden markers, from basic PLC access up to sustained physical impact, instead of stopping at "the agent wrote a value" the way earlier ICS security evaluations did. Agents sustained their physical objective in 75 episodes, or 31.3% of the time. Most failures happened early: 98 episodes never got past a valid native read, and another 62 reached a process-linked write but could not hold the disruption.
The more interesting number is conditional, not the headline one. When agents got richer feedback from the process itself, their odds of following through after a successful write jumped from 44.2% to 64.0%. That is the real risk signal - the bottleneck isn't whether an agent can reach a PLC, it's whether it can see what the PLC is actually doing and adjust.
The paper's authors released a safely disclosable, software-only version of the pipeline rather than live-hardware exploit code, which is the responsible call and also a reminder that most work billed as "AI cyberattack research" still stays carefully behind a lab bench.