Booz Allen lab finds frontier AI met OT goals

Booz Allen says frontier models finished all eight isolated OT lab goals, with outlets disagreeing on what the roughly 16-minute timing measured.

Booz Allen Hamilton reported that frontier AI models completed all eight defined attack objectives on an isolated, multi-vendor manufacturing-style OT testbed in Chantilly, Virginia. The Register identified two unnamed models from leading providers; the other outlets did not give a model count. Reported effects included asset mapping, forcing PLC outputs, changing a variable-frequency drive, taking over an HMI, manipulating a SCADA interface, and moving a robotic arm. Outlets disagree on the roughly 16-minute figure: earlier reports place just over or a little more than 16 minutes on a path from a perimeter foothold into the industrial or control network, while Dark Reading says a model took control of and moved a robotic arm in 16 minutes, and SecurityWeek separately says the arm was mapped and moved within minutes. Approval and defense accounts also differ. The Register required human approval before exploitation or physical impact and extra caution on safety-critical devices, Help Net Security limited stated sign-off to physical action, and SecurityWeek said no single existing safeguard consistently stopped agents that had no prior documentation. Booz Allen said this was a lab test rather than a confirmed incident. Separately, Dragos reporting conflicts: one account describes a May Claude-assisted look at Mexican government networks that flagged a water-sector interface without confirmed control-system access, while Dark Reading describes an early-2026 AI-assisted intrusion into at least nine Mexican agencies that failed to reach a local water utility’s OT network.

• Booz Allen Hamilton tested frontier AI on an isolated, multi-vendor manufacturing-style OT lab in Chantilly, Virginia; The Register said two unnamed models from leading providers, while other outlets did not state a model count.
• All eight defined attack objectives were completed, including asset mapping, forcing PLC outputs, changing a variable-frequency drive, taking over an HMI, manipulating a SCADA interface, and moving a robotic arm.
• Timing differs by outlet: just over or a little more than 16 minutes is variously tied to reaching the industrial or control network, while Dark Reading says a model moved a robotic arm in 16 minutes and SecurityWeek says the arm was…
• The Register said compromising one SCADA gateway exposed live pre-auth sessions to 14 OT devices, and that agents used extra caution on safety-critical devices.
• Human-approval accounts differ: The Register said approval was required before exploitation or physical impact; Help Net Security limited stated sign-off to physical action.
• SecurityWeek said agents had no prior documentation and that no single existing safeguard consistently stopped them, though some defenses slowed or blocked actions.
• Booz Allen framed the work as a lab test, not a confirmed incident; Kyle Miller said the speed undercuts OT security-through-obscurity.
• Separately, Dragos accounts disagree: Help Net Security described a May Claude-assisted reconnaissance of Mexican government networks that flagged a water-sector interface without confirmed control-system access; Dark Reading described an…