Frontier AI models completed eight attack-oriented objectives in an isolated industrial-security laboratory, according to research published by Booz Allen Hamilton. The firm says one model moved from a perimeter compromise to actions within an industrial control network in just over 16 minutes; another found and moved a robotic arm within minutes. These were controlled tests with human approval before exploits and physical actions, not autonomous attacks on an operating utility or factory.
What the lab tested
Booz Allen built a multi-vendor environment modeled on a manufacturing facility. It included programmable logic controllers, supervisory control and data acquisition software, operator interfaces, workstations, network equipment, sensors and a robotic arm. The firm did not give the models source code, engineering documents or advanced guidance about the target systems. In the scenarios it described, the agents identified assets, matched details to vulnerabilities, adjusted plans when a route failed and, when authorized, altered equipment behavior.
One example involved a supervisory system whose first attack path failed because the agent targeted the wrong operator-interface version. The agent then examined active sessions, found the version in use and identified pre-authenticated connections from a SCADA gateway to 14 operational-technology devices. In another test, a model located a robotic arm, discovered its interface, mapped protection zones and motion limits, and moved it. The Register's account says Booz Allen did not name the two frontier models it tested.
What the results do and do not show
All eight objectives were met in Booz Allen's test environment, but that does not mean an AI agent could shut down any power or water system on demand. The firm says the effects at a real site would depend on its architecture, existing access, equipment and safety safeguards. Human testers approved every exploitation step or action that might have physical consequences, so the evaluation does not establish that the full chains would run without human involvement.
Some defenses also worked. Booz Allen says a controller refused a stop command, a motor in local-control mode could not be started remotely, and segmentation or endpoint controls slowed or blocked other paths. The models sometimes adapted, which is why the research points to layers of protection rather than a single control. The relevant operational question is which systems bridge enterprise and plant networks, and what physical changes an attacker could make after reaching them.
Booz Allen recommends tighter segmentation around high-consequence processes, attention to jump hosts and supervisory systems, monitoring for controller-mode changes and program writes, and tested backups of known-good configurations. The study provides evidence that AI can accelerate some OT attack steps in a lab. It does not establish a real-world campaign or a universal failure of industrial defenses.