Booz Allen Frontier AI Models Clear All Eight OT Attack Objectives in Lab Test
Booz Allen demonstrated that frontier AI models can autonomously breach industrial control systems and manipulate physical equipment within minutes.
Key points
- Models completed all eight attack goals in an isolated Chantilly, Virginia testbed.
- One model breached the perimeter and acted in the control zone in over 16 minutes.
- AI identified safety-critical relays and manipulated SCADA interfaces without prior guidance.
Booz Allen tested frontier AI models against an isolated industrial-control testbed in Chantilly, Virginia, and the models successfully cleared all eight defined attack objectives, according to Help Net Security. The firm observed the artificial intelligence systems mapping networks, identifying weaknesses, and ultimately manipulating physical equipment, though the models paused for human sign-off before any physical actions occurred.
The testbed simulated a manufacturing plant environment using hundreds of IT and operational technology devices, including real controllers, a SCADA platform, motor drives, sensors, and a robotic arm wired into layered zones typical of a working factory. The AI models mapped the network, tied specific equipment to known vulnerabilities, wrote functional exploits, and pivoted into production systems. In the final stage, one model located the robotic arm, assumed administrative control, and moved it physically.
Autonomous Exploitation and Speed
In one specific run, a model progressed from breaching the network perimeter to executing actions inside the control zone in just over 16 minutes, a timeframe that leaves defenders working at human speed with minimal opportunity to intervene, according to the report. The operators provided the models only with subnet boundaries, withholding code, engineering documents, and operational technology guidance. From this limited information, the models constructed detailed attack plans independently.
One model identified a protective relay, a safety-critical device that trips breakers during electrical faults, broadcasting unanswered network requests once per second. The AI flagged the relay’s importance and independently determined how to impersonate the communications partner the relay sought, creating a path to eavesdrop and potentially seize control under specific conditions. The models also demonstrated resilience by recovering from dead ends during the attack process.
SCADA Manipulation and Network Reach
During the SCADA software test, a model initially edited the wrong version of the operator interface and observed no changes on the displays. It then listed live sessions, located editable code in an exported project, rebuilt its payload, and pushed a full-screen takeover to the control room, according to Help Net Security. This capability allowed the model to send real commands to controllers while simultaneously falsifying operator screens.
The same model discovered that a single SCADA gateway maintained live, authenticated sessions to fourteen OT devices across both process cells, including every programmable controller it had identified. This single foothold provided access to all fourteen devices simultaneously. While firewalls, segmentation, and endpoint tools slowed the models or flagged unusual activity, the AI persisted. One controller refused a stop command initially, and a local setting blocked a remote motor start on another run, but the overall test concluded with full objective completion.
What should you do?
Organizations should review their operational technology network segmentation to ensure that single gateway compromises cannot grant access to multiple critical controllers. Security teams need to monitor for unusual network requests from safety-critical devices like protective relays, as AI models may exploit these patterns. Defenders should verify that operator interface code is locked down and that exported projects do not contain editable payloads.
What to do and how to stay safe: Booz Allen
- Audit SCADA gateway sessions to ensure they do not maintain persistent, authenticated connections to multiple OT devices simultaneously.
- Monitor network traffic from safety-critical hardware, such as protective relays, for repeated unanswered requests that could indicate impersonation attempts.
- Restrict access to operator interface code and verify that exported project files cannot be edited to inject malicious payloads.
- Implement strict segmentation between IT and OT zones to delay autonomous attackers from reaching physical control systems.
Step-by-step guide: Risk Based Vulnerability Management: Prioritize Fixes by Actual Threat
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How long did it take for the AI model to breach the control zone?
One model went from breaching the perimeter to acting inside the control zone in just over 16 minutes.
Did the AI models have access to engineering documents or code?
No, operators handed the models only subnet boundaries, providing no code, engineering documents, or OT guidance.
What physical equipment did the AI models manipulate?
The models found a robotic arm, took administrative control of it, and moved it during the final test phase.
