AI has 'potential' to turn script kiddies into sophisticated infrastructure attackers

Frenos tested AI models in 16,980 tasks from October 2025 to September 2026, finding that the strongest three frontier models produced workable plans in about 90% of planning attempts, but only 60%, 62.9% and 74.3% of their plans passed every repeat. Overall choice success ranged from 6% to 47%; the best open-weight model achieved 36.2%, exceeding three US frontier models at 31.9%, 18.8% and 17.9%. Experts said AI can speed reconnaissance and lower barriers to OT attacks, while stressing that model errors remain common and human judgment is essential; Frenos recommends layered defenses, including network segmentation and restricted remote access.

Analysis

This is a modest increase in the tail-risk premium for OT-dependent operators, not evidence of a near-term rise in successful outages. The market mechanism is likely gradual: more scrutiny of remote access, segmentation and recovery testing could raise security spend and implementation burden, while procurement cycles and legacy-system constraints limit near-term revenue conversion for vendors. Utilities such as AEP may face higher compliance and resilience costs over time, but the article provides no evidence of a breach, changed guidance or company-specific exposure sufficient to alter its earnings outlook.

Cybersecurity providers with credible OT coverage could benefit if boards convert concern into funded programs; however, the reported tests are from a security company, model identities are undisclosed, and simulated planning success is not equivalent to an executable attack. Treat the findings as a catalyst for diligence, not proof of a step-change in demand. Google’s ownership of Mandiant does not establish a direct benefit or financial impact here: the comments are from former Mandiant personnel, and no product, contract or revenue linkage is identified.

Over 1–3 months, watch for utility security-budget commentary, regulator requirements and disclosed OT incidents. Over 6–18 months, the structural effect depends on whether utilities accelerate remediation despite cost and downtime constraints. The contrarian point: attention may overstate the immediate danger; inconsistent plans and hallucinations still create meaningful execution friction, while basic access controls and tested recovery may matter more than buying new AI tools. Reassess the risk premium if incidents or regulatory mandates emerge; absent those, this is not a standalone short thesis on AEP or a catalyst for GOOG.

Key Decisions for Investors

• No trade on AEP or GOOG from this article alone. AEP is a useful utility exposure to monitor, but there is no company-specific incident, spending disclosure or guidance change to underwrite a position.
• Add OT cybersecurity vendors to diligence rather than chasing the headline: verify actual utility/manufacturing customer wins, recurring revenue contribution and deployment capacity before taking a long position.
• Set an alert for utility earnings and regulatory updates over the next 1–3 months; upgrade the theme only if security budgets or mandatory controls translate into measurable contracts or disclosed cost increases.
• Falsification/watch items: no increase in OT incidents or regulatory requirements, continued low conversion of security plans into funded projects, or evidence that deployments are delayed by legacy-system and downtime constraints.