Booz Allen Hamilton turned frontier AI models loose on a replica factory network and they met every attack goal it set them, including moving a robotic arm. For UK operators of water, energy and manufacturing plant, the takeaway is that the expertise needed to attack OT is no longer much of a barrier, and defenders may have only minutes to respond.
What happened
Booz Allen Hamilton, the US consultancy, has published research testing how far frontier AI models can get when they are pointed at operational technology. It has been reported since 11 October by The Register, IoT Tech News and Help Net Security. It extends the firm’s Cyber Weapon Index work from enterprise IT into industrial control.
The tests ran in Booz Allen’s isolated OT Cybersecurity Lab in Chantilly, Virginia. It set eight attack objectives, from mapping the environment and finding critical assets to manipulating controllers, changing the speed of an AC motor, taking over SCADA operator screens and moving a robotic arm. The models achieved all eight. In one run, a model got from an initial breach at the edge to acting within the control network in a little over 16 minutes.
Booz Allen has not named the models. It told The Register they were two of the latest frontier systems from leading AI providers. Kyle Miller, who leads infrastructure cyber security at the firm, warned that agents could outpace organisations without basic OT controls in place.
The technical picture
The testbed was built to look like a typical manufacturing site, split into four layers (enterprise, an industrial DMZ, plant operations and production) linked by firewalls and switches. Inside were programmable logic controllers, HMIs, engineering and operator workstations, a SCADA platform, a variable-frequency drive, sensors and a robotic arm. Booz Allen deliberately mixed vendors, firmware versions and imperfect segmentation to mirror the technical debt found in long-lived plants.
The models were given subnet boundaries and plain-language prompts, and nothing else: no source code, no engineering drawings, no OT tuition. Human operators had to approve every exploit and any step that could have a physical effect, and the agents were told to take particular care around anything they judged safety-critical.
First, the models spotted subtle opportunities. One noticed a protective relay repeatedly calling for a communications partner that no longer existed, flagged it as safety-critical, and worked out that it could pose as the missing peer to intercept traffic. Second, they found architectural shortcuts. One SCADA gateway held live, pre-authenticated sessions to 14 field devices across two plant zones, so one foothold reached every PLC the model had found. Third, they recovered from failure. When a first SCADA attack hit the wrong HMI version, the model checked active sessions, found editable Jython scripts in an exported project, reworked the payload and took over the control room displays.
No novel exploits were needed. Help Net Security reports that the models leaned mainly on default passwords and the native protocols the equipment already speaks. What changed was tempo: discovery, research, exploit development and troubleshooting that would normally take several specialists days were completed in one run.
Some controls held. A controller rejected a stop instruction, and a motor switched to local control ignored remote start attempts. Network filtering, zoning and endpoint products added friction or generated alerts. But Booz Allen found that no single safeguard stopped them consistently, because the models would often switch technique or take another path.
Why it matters for UK organisations
The UK has a large estate of ageing OT across water, energy, transport and manufacturing, much of it run under the NIS Regulations and assessed against the NCSC’s Cyber Assessment Framework. The Cyber Security and Resilience Bill would widen that regime to more essential and digital service providers and their suppliers. This research shows an AI-assisted attacker does not need years of industrial experience to understand an unfamiliar vendor’s control environment; the model does the reading for them.
The physical stakes are not theoretical. Both Help Net Security and IoT Tech News note that a UK gas-turbine plant was knocked out for four days by a cyber attack within the past six months, alongside disruption at water utilities in at least seven US states. No one has publicly linked either to AI. But attackers already reach these outcomes conventionally; AI shortens the route.
The 16-minute figure matters most for operators whose OT monitoring is reviewed the next morning. At that pace, overnight alert queues are not detection in any useful sense.
Expert view
None of this surprises me as a tester, and that is the uncomfortable part. When we assess OT environments, the findings that let us reach controllers are almost always the same: dual-homed hosts, flat networks behind a nominal DMZ, shared services that cross zones, default passwords on engineering interfaces, and protocols such as Modbus that have no authentication at all. Booz Allen has shown a model can chain them in minutes without being taught what a PLC is.
Two cautions. This was a lab with human approval gates and no real production pressure, so it measures capability rather than forecasting attacks next week. And the models were not producing new classes of exploit; they were exploiting hygiene failures that asset owners have been told about for over a decade. The good news is that the fixes are known and work against humans and machines alike.
The detail I would put in front of any board is the SCADA gateway with 14 live, pre-authenticated sessions. In my experience, that kind of convenience link exists in a lot of plants because it makes operations easier, and it is exactly what turns one compromised box into control of a whole site.
What to do now
- Find and remove boundary-crossing shortcuts. Hunt for dual-homed hosts, shared services and persistent pre-authenticated sessions that bridge IT and OT zones. This maps to Cyber Essentials firewall and secure configuration controls, applied properly to the plant network.
- Change default credentials on every engineering and administrative interface, including robots, drives, HMIs and SCADA servers, and enforce multi-factor authentication on remote access and jump hosts (Cyber Essentials user access control).
- Prioritise by physical consequence, not CVSS. For each vulnerable asset, trace what it can reach and what that access could change in the process.
- Harden the bridging systems: firewalls, switches, jump hosts, engineering workstations and SCADA platforms deserve the strictest patching and monitoring (Cyber Essentials security update management and malware protection).
- Monitor for operational change in near real time. Alert on controller mode changes, logic downloads and SCADA project imports, and on trusted interfaces being used unexpectedly, with a response path measured in minutes.
- Keep local safety controls and manual modes in place, and hold tested backups of controller logic and known-good configurations so you can restore quickly.
Bottom line
Booz Allen’s lab work does not show AI inventing new ways to break industrial systems. It shows AI exploiting old weaknesses faster than most operators can notice. For UK critical infrastructure, the response is not new technology but finishing the segmentation, credential and monitoring work that has been on the to-do list for years, before an attacker’s agent does the reconnaissance.
Sources
- Booz Allen Hamilton: Super Intelligence Reached OT Systems and Moved Equipment
- The Register: AI systems are fully capable of carrying out nightmare attacks against infrastructure and nobody’s ready
- Help Net Security: Frontier AI cleared every OT attack goal Booz Allen set in its lab
- IoT Tech News: Booz Allen tests reveal AI breached industrial controls in 16 minutes
