Eight scenarios, eight objectives met
Booz Allen Hamilton ran two frontier AI models against an isolated industrial control network built to imitate a manufacturing plant, and reported that the models met every objective it set.
In one scenario, the models went from a compromise at the perimeter to taking action inside the industrial control network in just over 16 minutes. In another, a model located a robotic arm, worked out its protection zones and motion limits, and moved it within minutes. Booz Allen says the models had no source code, no engineering documents and no specialist guidance on operational technology to work from.
The consultancy will not name the models, describing them only as recent releases from leading providers. That is a real limit on what the result tells you: a reader cannot check it against a vendor’s own safety card, and cannot tell whether a safeguard any particular lab ships would have changed the outcome.
What the models actually did
The lab put the work in the order a human intruder would. The models identified unfamiliar equipment, matched asset and firmware details to known vulnerabilities, built attack paths, and — where a human approved it — changed the state of physical equipment.
A test on a safety relay is the clearest illustration. The models noticed that the relay was repeatedly searching for a communications partner that was not answering, and identified a way to impersonate that missing peer. Nothing about that is exotic; it is the kind of observation a patient engineer makes, arrived at quickly and without documentation.
In a SCADA test, the first attempt failed because the models targeted the wrong version of the operator interface. They then checked which sessions were active, revised the payload and found live, pre-authenticated connections to 14 devices on the operational network.
The defences that held, and the ones that did not
The most useful part of the report is the failures. A controller rejected a stop command. A motor that had been set to local control would not start remotely. Firewalls, network segmentation and endpoint protection slowed or blocked other steps.
But Booz Allen’s conclusion is that no single safeguard consistently stopped the models from reaching their objective. Defence in depth worked as an aggregate and failed as individual controls, which is the usual finding in physical security and an uncomfortable one when the attacker does not get tired.
“Some OT organizations are prepared, but many are not,” said Kyle Miller, vice-president for infrastructure cybersecurity at Booz Allen. He argued that agents can work with a speed, persistence and engineering-level precision that may outpace the organisations defending against them.
The caveats that matter
Human operators approved every exploit and every action with a possible physical effect, so this was not an autonomous run. The environment was a lab, not an operating plant, and Booz Allen says the consequences at a real facility would depend on its architecture, equipment, safeguards and the access an attacker had obtained.
Those caveats cut both ways. Approval gates mean the models were not tested on whether they would cross a line unprompted. They also mean the 16 minutes measures capability, not restraint.
What to watch
The practical number here is the detection window. If a capable operator can be inside a control network in a quarter of an hour, the monitoring that assumes days of reconnaissance is mis-specified.
Watch whether asset owners publish their own timings rather than relying on a consultancy’s lab, and whether model providers begin reporting operational-technology capability the way they now report cyber-offensive capability. Until they do, every organisation running a plant is working from someone else’s unnamed models.
