Analysis
Booz Allen Hamilton's cybersecurity lab tested two unnamed frontier AI models against a simulated manufacturing facility and found both completed all eight stages of a factory takeover -- from mapping the network to physically moving a robotic arm -- according to The Register. Kyle Miller, the firm's VP of infrastructure cybersecurity, said the models were "two of the latest frontier models from the leading AI providers," without naming them.
Eight Stages, 16 Minutes
The test environment modeled a general manufacturing plant with enterprise, DMZ, operations and production zones, including PLCs, HMIs, a SCADA platform, a variable-frequency drive and a collaborative robotic arm. The AI agents received no source code or engineering documents and needed human approval before exploiting a flaw or taking a physically impactful action -- safeguards a real attacker wouldn't have. Even so, the agents mapped the environment, found vulnerabilities, gained access, moved into production systems, manipulated controllers, changed motor speed, compromised the SCADA operator screen and moved the robotic arm, completing all eight objectives. In one run, an agent found and moved the arm within minutes; in the SCADA test, one gateway held live, pre-authenticated sessions to 14 OT devices, making lateral movement trivial once the agent was inside.
Booz Allen says the underlying problem is structural, not model-specific: operational technology in most plants was built assuming physical isolation, so many devices run without authentication or encryption. An AI agent that would once have needed years of specialized OT training to navigate a SCADA environment can now learn it on the fly, closing a skills gap that used to be the main thing standing between a generic attacker and a safety-critical system.
The Response Is Already Running Behind
The findings land alongside real-world precedent The Register cites: suspected Chinese state actors reportedly used AI agents against South Korean financial institutions and Taiwanese government sites, and suspected Iranian attackers reportedly used AI-generated exploit code against internet-exposed PLCs at US facilities. OpenAI, Anthropic and Google have each rolled out initiatives this year offering critical-infrastructure operators access to their models for defense rather than offense, but Booz Allen's test ran against commercially available frontier models with no special jailbreak -- meaning the offensive capability is already general-purpose, not confined to a state actor's custom tooling.
Miller's own framing is a useful gut check for anyone diligencing a security vendor right now: "Some OT organizations are prepared, but many are not." The gap between the two groups is where the next wave of OT-security funding is likely headed, and the test's 16-minute window -- from perimeter breach to inside the production network -- is a much harder bar to clear than the detection times most incident-response SLAs are written against today.
