How long before an AI can plan a cyberattack on a power grid? A new study from cybersecurity firm Frenos — its first annual “State of AI in OT Security” report — says: give it about two years. The researchers tested ten AI models on planning attacks against the industrial systems that run power grids, water treatment plants and other critical infrastructure — and found the best models produced workable attack plans in roughly 90% of attempts.
Here is what the study actually did, what it found, and — because this is a vendor’s own research — what it did not prove.
What exactly did Frenos test?
Frenos ran ten AI models — six top-tier “frontier” models and four open-weight models — through roughly 17,000 tests conducted between October 2025 and September 2026. The models were put through more than 500 safe, non-executable simulations of operational technology — the industrial control systems that monitor and run physical equipment like power turbines and water treatment processes. Each model went through six identical rounds of testing to measure how consistently it succeeded.
In 2,520 dedicated attempts, models were given information about potential targets and asked to construct complete attack plans: asset-by-asset, weakness-by-weakness, step-by-step.
What did they find?
The three strongest frontier models produced workable attack plans in roughly 90% of attempts — organizing information about a target’s assets, weaknesses and access into steps an attacker could act on. In guided simulations where researchers gave feedback, all models successfully executed attack plans more than 90% of the time.
But there was a catch that the headline numbers bury. When researchers repeated the same task under identical conditions, the three leading models returned a passing plan only about two-thirds of the time — between 60 and 74%. Failed attempts skipped required steps or assumed access the attacker had not actually established. In other words: the models can usually sketch the plan, but they cannot reliably reproduce it.
What about open-source models?
This is where the picture splits. The strongest foreign open-weight model succeeded in 36.2% of attempts — while the strongest US open-weight model managed only 5.2%. Most open-weight models, in Frenos’s words, “fall far short.” That gap is the study’s most politically charged finding: the models an attacker could download and run in private are, for now, much less capable than the closed models behind corporate APIs.
So should everyone panic?
Not quite. Three caveats matter. First, the models were handed the target information — they did not find targets on their own, and the study demonstrated no autonomous attacks. Second, the researchers concluded that AI-generated attack plans still need skilled human review: the models regularly made mistakes, and without an experienced attacker to catch them, the plans have limited reach. Third, Frenos did not name the models it tested.
Still, Steve Swick, a former chief information security officer at American Electric Power who briefed on the findings, described the pace of advancement as “a clock moving faster than ever seen” — and Frenos estimates critical infrastructure operators have roughly two years before AI-assisted attack planning becomes a reliable capability for attackers.
What does Frenos recommend?
The company’s advice to defenders: prioritize detection and response (AI-assisted activity tends to be noisy and leaves signals defenders can catch), use AI on your own systems first — “Defenders have an advantage attackers don’t: they have all the data. An attacker has to collect it from you bit by bit” — and assess exposure across whole systems rather than one vulnerability at a time.
Why this matters
Earlier this month, hackers turned French supermarket freezers up to 50°C overnight and spoiled millions of euros of food — a crude reminder that industrial systems are already being attacked through software. The Frenos study is not proof that AI can take down a grid tomorrow. It is a measurement of how fast the tool that helps attackers plan is improving — and a two-year warning for the people who defend the systems everyone depends on.
Related on Informopedia: 400 scientists signed an AI safety letter demanding powerful AI be cut off from the internet, and how hackers turned French supermarket freezers up to 50°C.
