Frontier AI cleared every OT attack goal Booz Allen set in its lab

Booz Allen set frontier AI models against an isolated industrial-control testbed in its Chantilly, Virginia lab and watched them clear all eight attack objectives it had defined.

The Booz Allen frontier AI OT test architecture (Source: Booz Allen)

The models mapped the network, tied equipment to known weaknesses, wrote working exploits, pivoted into the systems that run production, and in the last test found a robotic arm, took administrative control, and moved it.

The testbed stood in for a manufacturing plant. Hundreds of IT and operational technology devices, real controllers, a SCADA platform, a motor drive, sensors, and that arm, wired into the layered zones a working factory uses.

In one run a model went from breaching the perimeter to acting inside the control zone in just over 16 minutes, which leaves a defender working at human speed almost no room to step in. Under the test’s rules, the models paused for human sign-off before anything physical happened.

The operators handed the models subnet boundaries and nothing else: no code, no engineering documents, no OT guidance. From that alone, the models built detailed plans. In one test a model noticed a protective relay, the device that trips breakers when it senses an electrical fault, broadcasting the same unanswered network request once a second. It flagged the relay as safety-critical and worked out on its own how to impersonate the communications partner the relay kept calling for, a path that could let it listen in and, under the right conditions, take control.

The models also recovered from dead ends. In the SCADA test, SCADA being the software operators use to watch and command a plant, a model first edited the wrong version of the operator interface, saw nothing change on the displays, then listed live sessions, found editable code in the exported project, rebuilt its payload, and pushed a full-screen takeover to the control room. The same model found that a single SCADA gateway held live, already-authenticated sessions to fourteen OT devices across both process cells, including every programmable controller it had identified. One foothold reached all fourteen at once. The model saw it could send real commands to those controllers and at the same time “make the operator screens lie.”

Firewalls, segmentation, and endpoint tools slowed the models or flagged unusual activity. One controller refused a stop command at first, and a local setting blocked a remote motor start on one run. But the models often switched methods or found another route. The harder lesson sits in the method. The AI mostly used the devices’ own protocols and default passwords, the same moves a skilled engineer could make. What it changed was the clock: a single run pulled together discovery, research, exploit-writing, and troubleshooting that used to take several specialists and days of work.

This is already showing up outside the lab. In May, Dragos reported an intrusion in which commercial AI, mostly Claude, enumerated the networks of several Mexican government organizations and singled out a water-sector management interface as a route toward OT. There was no evidence the attacker reached the control systems, and Dragos’s reading lined up with Booz Allen’s: the AI built no novel exploit, but it cut the time and expertise needed to find the target and plan the approach.

Real attacks have already caused physical damage. Over the past six months, attackers have disrupted water and wastewater utilities in at least seven U.S. states, causing pressure loss and flooding, and have knocked a UK gas-turbine plant offline for four days. None of these incidents has been publicly attributed to AI, but they are the kind of physical outcome the models could help reach faster.

Download: The Agentic Software Development Guide