Booz Allen says AI completed all eight industrial attack tests in a guarded lab

AI models did more than find weaknesses in industrial networks: they reached controls and moved equipment, according to Booz Allen Hamilton’s new study. Every defined objective was achieved across eight controlled scenarios. But these were not attacks on operating facilities. Humans approved every exploit and any action that could produce a physical effect.

The tests examined operational technology, or OT: the industrial systems where digital commands can affect machinery and production processes. Booz Allen built a multi-vendor environment modeled on a manufacturing facility inside its isolated OT Cybersecurity Lab. The models worked without source code, engineering documents or advanced OT guidance.

Booz Allen declined to name the two models, describing them as recent frontier systems from leading AI providers, The Register reported. That leaves readers unable to connect the results to a particular publicly available product. The lab contained industrial controllers, operator interfaces, a supervisory control platform, a motor drive and a robotic arm.

From network access to moving machinery

In one scenario, the models went from a perimeter compromise to actions inside an industrial control network in just over 16 minutes. Across the evaluation, they connected equipment discovery, device research, attack planning, troubleshooting and execution—work that Booz Allen says usually spans multiple people and stages.

The robotic-arm scenario made the physical consequences concrete. A model identified the arm, mapped its protection zones and motion limits, and moved it within minutes. Booz Allen’s infrastructure cybersecurity vice president, Kyle Miller, told The Register that the lab used a lightweight collaborative arm, rather than a full-size industrial robot.

The models also recovered from mistakes. In a test of the supervisory control and data acquisition platform, known as SCADA, they initially targeted the wrong operator-interface version. They checked active sessions, identified the version used in the control room and revised their attack. They then discovered live, already-authenticated connections to 14 OT devices.

Another test showed the models drawing useful conclusions from an unexpected condition. A model noticed a safety relay repeatedly looking for a missing communications partner. It identified a possible route to impersonating that partner. The finding was an opportunity the model recognized, not a reported physical attack on the relay.

Eight successes do not mean every defense failed

Firewalls, network segmentation and endpoint protection slowed or blocked some actions. The models sometimes switched methods or followed another application path, however. Booz Allen found that no single safeguard consistently prevented them from reaching their objectives. The overall success tally therefore sits alongside specific examples of controls doing their intended jobs.

Consequences at an operating facility would depend on its architecture, equipment, safeguards and the access an attacker obtained, Booz Allen cautioned. Miller also told The Register there was no defined timeline for a nightmare scenario. The study’s warning concerns demonstrated capability and speed, not a prediction that a particular infrastructure disaster is imminent.

Booz Allen’s priorities for industrial defenders

The firm’s recommendations focus on routes between systems and on changes that could affect equipment. It urges defenders to assess vulnerabilities by what an attacker could reach and alter, rather than treating a severity score as the whole risk picture.

• Separate high-consequence processes and remove shared services or already-authenticated sessions that cross security boundaries.
• Secure bridging systems, including firewalls, administrative interfaces, SCADA platforms and engineering workstations.
• Monitor controller-mode changes, program writes and unexpected use of trusted interfaces. Keep tested backups and known-good configurations ready for restoration.