Frenos, the industry’s only fully simulated AI penetration testing platform, today announced the release of its first annual report, The State of AI in OT Security, which tested frontier and open-weight AI models across more than 500 OT attack simulations, assessing how well today’s AI models can plan attacks against operational technology. The findings suggest critical infrastructure operators have roughly two years to prepare before AI-assisted attack planning becomes a reliable capability for attackers.

Frenos researchers tested frontier, U.S. open-weight and foreign open-weight models against more than 16,000 OT attack decisions and paths reviewed by experienced hackers, then ran each model as an agent inside 500 safe, non-executable simulations. Each model underwent six identical rounds of testing to measure how consistently it succeeded.

Given the same background information and context, three of the six frontier models tested produced workable attack plans in roughly 90% of attempts. They organized information about a target’s assets, weaknesses, and access into steps an attacker could act on. In guided simulations with researcher feedback, all models successfully executed attack plans more than 90% of the time.

That capability did not hold up on repetition. When researchers repeated the same task under identical conditions, the three leading models returned a passing plan only about two-thirds of the time. Failed attempts skipped required steps or assumed access the attacker had not established.

“A model can look brilliant once and fall apart when you run it again,” said Harry Thomas, CTO and co-founder of Frenos, who conducted the research. “These models still need the right context and an experienced human behind them to do real work. They’re not hacking industrial systems on their own, and when an attacker using AI slips up, it’s noisy and easy to catch. But frontier models are getting there fast. My estimate is about two years before this is a reliable capability in any attacker’s hands. Critical infrastructure operators should treat that as the time they have to prepare, not as a reason to wait.”

Capability varied sharply by model, even within the frontier tier. The three weaker frontier models succeeded roughly a third of the time or less. The strongest foreign open-weight model performed on par with them and outperformed the strongest U.S. open-weight model by roughly 7x, while still trailing the three leaders by a wide margin. That gap bears directly on the open-weight policy debate now underway in Washington.

“U.S. open-weight models just aren’t in the picture for this kind of work,” Thomas said.

“The model an attacker can reach for changes the threat a defender faces,” said Brian Proctor, founder and CEO of Frenos. “Frontier AI developers are holding a real superpower, and how tightly they control who uses their models and for what matters as much for critical infrastructure as anything defenders do.”

The research points to three conclusions:

  • Model choice matters. The gap between the strongest and weakest models was wide enough that which model an attacker uses changes the threat level a defender faces.
  • AI-generated attack plans need skilled human review. The models regularly made mistakes, and without an experienced attacker to catch them, the plans are limited in reach.
  • Autonomous attacks were not demonstrated. The models worked from information Frenos supplied and were scored on their plans and simulated runs. Neither result shows a model finding a target and attacking industrial systems on its own.

Frenos recommends that defenders use the window to:

  • Prioritize detection and response. AI-assisted activity tends to be noisy and leaves signals defenders can catch.
  • Use AI on their own environment first. “Defenders have an advantage attackers don’t: they have all the data,” Thomas said. “An attacker has to collect it from you bit by bit.”
  • Assess exposure across whole systems, not one vulnerability at a time.

Frenos presented the findings on Oct. 20 during a media briefing with Steve Swick, former CISO of American Electric Power, and Paul Shaver of Armadin, moderated by Rob Bair of Anthropic.

The State of AI in OT Security report is available at https://frenos.io/2026-ai-ot-report.

About Frenos

Frenos is the industry’s first fully simulated AI penetration testing platform, combining digital twin technology with an AI reasoning agent that thinks like an adversary to reveal every attack path in your OT environment, risk-free. Frenos transforms how operational technology (OT) cybersecurity teams assess the cybersecurity posture of mission-critical sites and environments, reducing assessment time from months to minutes with zero impact on operations. Follow our blog, connect with us on LinkedIn, or visit our website at www.frenos.io.

Media gallery

About The Author
Business Wire