Whatever a virus is able to do, AI can, theoretically, perform aswell. Ransomware, keylogging, social engineering (I’d argue this one is most likely - just look at people trusting whatever AI spits out with absolute confidence).

When you mentioned nuclear power plants, Stuxnet comes to mind for me.