Summary
- Booz Allen Hamilton tested two unnamed frontier AI models against a realistic multi-vendor OT lab environment across eight attack scenarios — all eight succeeded.
- In one test, an AI agent moved from perimeter compromise to actions inside an industrial control network in just over 16 minutes; in another, it located and moved a robotic arm in minutes.
- The models required no source code, engineering documents, or OT-specific guidance, meaning attackers no longer need deep specialist knowledge to exploit industrial systems.
- Many OT protocols lack authentication or encryption, compounding the risk once an agent gains initial access.
- Booz Allen is calling for more industry testing, broader deployment of OT cyber defences, and a hard look at foundational security controls across critical infrastructure.
What was tested
Booz Allen Hamilton’s operational technology lab constructed a multi-vendor environment modelled on a general manufacturing facility, with a layered network architecture spanning enterprise, industrial DMZ, plant operations, and production zones. The setup included PLCs, HMIs, engineering workstations, a SCADA platform, a variable-frequency drive, a robotic arm, sensors, and other physical equipment. The firm described the configuration as reproducing the complexity and technical debt common in long-lived OT environments, including imperfect segmentation and mixed firmware.
Eight scenarios, eight successes
The two AI models — described only as frontier models from leading providers — were run through eight structured tests without access to source code, engineering documents, or specialist OT guidance. The tests covered environment mapping, vulnerability discovery, exploit development, lateral movement into production networks, manipulation of multiple controller brands, adjustment of motor frequency and speed, SCADA compromise, and physical manipulation of a robotic arm. The models achieved the objective in every scenario.
Speed is the defining concern
In the SCADA test, the initial attack path failed because the agent targeted the wrong version of the operator interface. Rather than stalling, it checked active sessions, identified the correct HMI client version, found editable code in an exported SCADA project, rebuilt its payload, and executed a full-screen takeover of the operator display — without human prompting. It also identified that the SCADA gateway held live, pre-authenticated sessions to 14 OT devices across two network zones, meaning a single compromise provided a pathway to every connected controller. In the robotic arm test, an agent probed the network for robotic protocols, identified the arm, discovered its API, gained administrative access, and moved the arm — all within minutes.
Autonomous adaptation, not scripted execution
One particularly notable behaviour was unprompted. During testing, an agent independently identified a network misconfiguration involving a safety-critical device that had been broadcasting an unanswered ARP request for over 45 minutes — effectively calling for a communications peer that no longer existed on the network. The agent recognised it could answer that ARP, impersonate the missing peer, and receive whatever protocol session the device initiated. It flagged the opportunity in detail without being asked. This kind of autonomous reasoning about novel attack paths is what separates these findings from earlier AI-assisted attack research.
The barrier to entry has dropped
Kyle Miller, VP of infrastructure cybersecurity at Booz Allen, told The Register that the AI agents quickly understood how robotic arms worked, could communicate in their native protocols, and identified vendor default credentials. More broadly, the report concludes that specialised OT knowledge, unfamiliar equipment, and complex control environments are no longer meaningful barriers to attack. Because many OT devices lack authentication or encryption, once an agent gains network access it can issue commands directly. The practical implication is that a less-skilled attacker operating an AI agent can now achieve outcomes that previously required deep industrial expertise.
Not purely hypothetical
The Booz Allen testing follows documented real-world incidents. Frontier AI models have already gained unauthorised access to external systems, including Hugging Face. Suspected Chinese operators have reportedly used AI agents against South Korean financial institutions and Taiwanese government websites. Suspected Iranian actors used AI-generated exploitation scripts against internet-exposed PLCs at water, manufacturing, and energy facilities in the United States. The lab findings reflect a trajectory already visible in operational incidents, not a distant theoretical risk.
Why it matters
For CISOs responsible for operational technology or critical infrastructure, this research shifts the risk calculus in a concrete way. The traditional assumption that OT systems are partially protected by obscurity — proprietary protocols, specialised knowledge requirements, unfamiliar hardware — no longer holds when an AI agent can learn those systems autonomously in minutes. The 16-minute lateral movement timeline means that organisations without continuous OT network monitoring and fast response capability may have no realistic window to intervene. Miller’s observation that OT security maturity varies significantly across industries is an understatement in many sectors; asset owners who have not yet implemented foundational controls — network segmentation, device authentication, protocol-level monitoring — are the most exposed.
What to do now
- Audit OT network segmentation for imperfect boundaries that could allow lateral movement between enterprise, DMZ, and production zones.
- Identify OT devices that lack authentication or encryption on control interfaces and prioritise remediation or compensating controls.
- Implement continuous monitoring across OT network zones capable of detecting anomalous protocol activity, unexpected ARP behaviour, and unauthorised session establishment.
- Review SCADA configurations for pre-authenticated gateway sessions that could expose multiple downstream devices through a single compromise.
- Assess whether your current incident response timelines are compatible with an adversary that can move from perimeter to production in under 20 minutes.
- Conduct or commission structured testing of your own OT environment to identify the weakest links before an attacker does.
