# OT/ICS AI Attack Feasibility Lookup

> OT/ICS AI Attack Feasibility Lookup is a paid API for AI agents from ot-intel-api.onrender.com, paid per call via x402, $0.2/call, status unknown (last checked 2026-09-14).

Looks up whether off-the-shelf LLMs can generate working ICS attack code for a given MITRE technique, vendor, or known campaign, based on a peer-reviewed study.

## Facts

- Endpoint: GET https://ot-intel-api.onrender.com/ot/ai-attack-feasibility
- Price: $0.2/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/ot-ics-ai-attack-feasibility-lookup-66fbd4b3
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_ypnFDAmOaM4wnNxghJxYc

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability ot-ics-ai-attack-feasibility-lookup-66fbd4b3
```

Example prompt: Using the Cook et al. AI attack feasibility study, look up whether off-the-shelf LLMs could generate working attack code for the Brute Force I/O technique (T0806) against Siemens equipment — I want to know if this is a realistic AI-assisted threat.

## When to prefer this

Use this endpoint when you need a fast, deterministic, research-backed answer on whether LLMs can realistically generate ICS attack code for a specific MITRE technique, vendor platform, or known ICS campaign — without invoking any LLM in the query path. Prefer this over general threat intelligence APIs when the specific question is about AI-assisted attack feasibility grounded in peer-reviewed empirical data.

## Known failure modes

- Missing all filter parameters (technique, vendor, campaign) — at least one required
- Vendor not in tested set (only Siemens, Schneider Electric, Rockwell Automation) — returns no data or error
- Campaign name not in tested set (Industroyer2, Fuxnet, FrostyGoop, INCONTROLLER, Stuxnet, Triton) — no match
- Unrecognized MITRE technique name or ID — returns empty result
- Service cold-start latency on Render free tier may cause initial delay

## How this service works

Deterministic lookup against Cook et al. (ACM TOPS 2026) testing whether off-the-shelf LLMs generate working ICS attack code. Pass technique (name/ID, e.g. 'Brute Force I/O' or T0806), vendor (Siemens, Schneider Electric, Rockwell Automation — only these tested), and/or campaign (Industroyer2, Fuxnet, FrostyGoop, INCONTROLLER, Stuxnet, Triton). Only Network/Register-Tags techniques succeeded; 1.08% success rate; Claude excluded (stronger guardrails). No LLM in lookup path.

## Output

Returns a deterministic lookup result from the Cook et al. (ACM TOPS 2026) dataset indicating whether LLMs succeeded in generating functional ICS attack code for the specified technique, vendor, and/or campaign, including success rates (overall 1.08%) and which technique categories (Network/Register-Tags only) proved feasible. No LLM inference occurs in the lookup path.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [],
     "properties": {
      "vendor": {
       "type": "string",
       "description": "Siemens, Schneider Electric, or Rockwell Automation — only these three vendors were tested in the study."
      },
      "campaign": {
       "type": "string",
       "description": "Industroyer2, Fuxnet, FrostyGoop, INCONTROLLER, Stuxnet, or Triton."
      },
      "technique": {
       "type": "string",
       "description": "MITRE ICS technique name or ID, e.g. 'Brute Force I/O' or T0806. At least one of technique, vendor, or campaign must be present."
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "query": {
   "vendor": null,
   "campaign": null,
   "technique": "Brute Force I/O"
  },
  "source": "Cook, Stoica, Shah & Pezaros, ACM Trans. Priv. Sec. 29, 3, Article 31 (June 2026), DOI: 10.1145/3815116",
  "technique_result": {
   "status": "llm_achievable",
   "category": "Register and Tags",
   "cvss_3_1": 5.7,
   "id_status": "confirmed_current_matrix",
   "cia_impact": {
    "integrity": true,
    "availability": true,
    "confidentiality": false
   },
   "technique_id": "T0806",
   "technique_name": "Brute Force I/O",
   "min_context_level": "High"
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/ot-ics-ai-attack-feasibility-lookup-66fbd4b3/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from ot-intel-api.onrender.com](https://www.zero.xyz/host/ot-intel-api.onrender.com/llms.txt)