Can the Same Agent Attack and Defend? An Empirical Capability Benchmark for Agentic AI in Industrial Control Systems

Agentic artificial intelligence (AI) systems, capable of autonomous planning, tool use, and multi-step reasoning, are increasingly proposed as both a defensive asset and an offensive threat to industrial control systems (ICS). Prior work has separately evaluated agentic AI's capacity to attack or defend such systems, but no study has tested a single agent framework in both roles under identical conditions. This study addresses that gap by deploying an open-weight large language model agent, openai/gpt-oss-20b via the Groq API, against the Graphical Realism Framework for Industrial Control Simulations (GRFICS), an open-source chemical process control supervisory control and data acquisition (SCADA) testbed, in two symmetric roles: autonomous attack execution targeting process manipulation, and autonomous anomaly detection against injected disturbances. Both roles were evaluated using identical tool-calling architecture across an initial pilot of eight episodes each. The attacker role achieved a 100 percent success rate, autonomously modifying and verifying a change to a live controller register in every episode. The defender role achieved 100 percent classification accuracy, correctly distinguishing four injected disturbances from four undisturbed baselines with no false positives or negatives. This first same-framework comparison of agentic AI's dual capability offers an initial empirical signal for industrial cybersecurity risk assessment and near-term monitoring priorities.