Frontier AI models hit every OT attack goal in Booz Allen lab, moved a robotic arm

Two frontier AI models completed every attack objective Booz Allen Hamilton set for them in an isolated industrial control testbed, including taking over a SCADA operator screen and moving a robotic arm, according to The Register and Help Net Security. In one run, a model moved from compromising the network perimeter to operating inside the industrial control zone in just over 16 minutes. The company says the results show defenders of operational technology (OT) environments may have only minutes to detect and stop such attacks.

What happened

According to The Register, Booz Allen built a multi-vendor lab in Chantilly, Virginia, modeled on a general manufacturing facility, with enterprise, industrial DMZ, plant operations and production zones separated by firewalls and switches. Help Net Security reported that the testbed included hundreds of IT and OT devices, real controllers, a SCADA platform, a variable-frequency drive, sensors and a robotic arm. The models were given only subnet boundaries, with no source code, engineering documents or OT guidance.

Booz Allen declined to name the models, describing them to The Register as two of the latest frontier models from leading AI providers. Guardrails required human approval before any exploit or physically impactful action, and extra caution around safety-critical devices.

Technical details

The eight tests covered asset mapping, vulnerability discovery, gaining access, moving into production systems, manipulating controllers, changing motor frequency and speed, compromising SCADA and operator screens, and moving the robotic arm. The models achieved all eight, both publications reported.

The Register said that in the SCADA test the agents first targeted the wrong HMI version, then adapted and used an administrative interface to push a full-screen takeover to the control room. A single SCADA gateway held live, authenticated sessions to 14 OT devices across two process cells, so one foothold reached all of them, according to Help Net Security. Without being prompted, one agent identified a misconfigured safety-critical protective relay and attempted to impersonate its missing communications partner. On the collaborative robot, the agents used vendor default credentials to gain administrative access and moved the arm within minutes.

Defenses did have an effect. Help Net Security reported that firewalls, segmentation and endpoint tools slowed the models or flagged activity, one controller initially refused a stop command, and a local setting blocked a remote motor start in one run. However, the models often switched methods or found alternate routes, mostly relying on the devices' own protocols and default passwords rather than novel techniques.

Who is affected

The findings are most relevant to manufacturers, utilities and other critical infrastructure operators. The report notes that many OT devices lack authentication or encryption, making malicious commands easier to execute, The Register reported. Kyle Miller, Booz Allen's vice president of infrastructure cybersecurity, told the publication that "some OT organizations are prepared, but many are not."

What to do

Booz Allen calls for more industry testing and broader deployment of cyber defenses across OT networks. Organizations should apply foundational OT security practices, and even those with established controls should review their posture, the company said. Practical priorities suggested by the test include replacing vendor default credentials, limiting persistent authenticated sessions from SCADA gateways, tightening segmentation between IT and production zones, and making sure monitoring can raise alerts within minutes rather than hours.