Artificial intelligence models can now help low-skill hackers plan attacks on power grids and water systems, but their success is spotty — ranging from 6 percent to 47 percent depending on the model, according to a new report from Frenos, a security firm that conducts AI penetration testing for operational technology environments. The report, published Wednesday, examined whether AI could assist someone in plotting an assault on industrial control systems. While the technology speeds up reconnaissance and lowers technical barriers, experts say human judgment remains critical for successful attacks.

Frenos tested 10 AI models — six frontier systems, two US open weight models, and two foreign open weight models — through 16,980 tests between October 2025 and September 2026. The tests included 13,884 decision attempts, 2,520 planning attempts, and 576 simulated attacks. The three strongest frontier models succeeded in roughly 90 percent of planning attempts, generating workable attack plans, but struggled with consistency: only 60 percent, 62.9 percent, and 74.3 percent of those plans passed every repeated trial. Among open weight models, the most capable non-US system achieved a 36.2 percent overall success rate, outperforming three US frontier models that scored 31.9 percent, 18.8 percent, and 17.9 percent respectively. Each test provided the model with background details, asset information, network data, known vulnerabilities, and a menu of attack actions to select from.

The report notes that plans often appeared reasonable but omitted essential steps or assumed access the attacker hadn't yet established. According to Harry Thomas, Frenos chief technology officer and co-founder, "We still think human judgment remains essential for these AI models to make the threat actors achieve whatever mission or goal they're trying to achieve." The tests didn't allow models to revise their mistakes, whereas a real attacker could spot gaps and ask for corrections. Paul Shaver, head of operational technology at Armadin and formerly global OT practice leader at Mandiant, said he's "very quickly building tools in days that would normally have taken me months" with AI assistance.

AI accelerates the timeline for attacks and expands the pool of potential threat actors, the report explains. Language models can rapidly parse through controller manuals and technical documentation to identify critical design flaws and exploit features in automation systems that weren't built with security in mind. Steve Swick, former chief information security officer at American Electric Power, pointed out that utilities have long relied on security through obscurity — the assumption that specialized knowledge protects them. That protection is eroding as AI makes technical information more accessible. If attackers with basic skills can now mount infrastructure assaults, defenders face more frequent attacks from a wider, less predictable array of adversaries whose capabilities are harder to assess.

Frenos recommends that defenders of operational technology adopt layered protection strategies, including network segmentation, restricted remote access, tighter user permissions, and regular testing of recovery procedures. Thomas emphasized executing existing business continuity and disaster recovery plans rather than creating new frameworks. The report's findings suggest that while AI won't instantly transform novices into nation-state-level hackers, the gap is closing as models improve and technical barriers fall. Organizations safeguarding critical infrastructure face a narrowing window to strengthen defenses before AI-assisted attacks become both more common and harder to attribute. The shift matters less for what AI can do alone today and more for how quickly it's changing the calculus of who can threaten essential systems and how much time defenders have to respond.