- What: Booz Allen Hamilton pointed AI agents built on commercial frontier models at an air-gapped OT lab modeled on a manufacturing plant. The agents completed all eight steps of an attack chain, from mapping the network to moving a robotic arm and taking over a motor.
- Why it matters: Attacking a water plant or a substation used to require rare protocol expertise. AI is lowering that bar, and the experts quoted agree water and power are where it shows up first.
- The catch for attackers: The agents were noisy. Segmentation and firewalls slowed them down. An attack that is loud gets caught, if someone is listening.
- What we do: RedEye brings Caver, Carbide endpoint protection, our own threat intelligence and a dedicated SOC that watches OT and IT together, so the noise these attacks make is heard and acted on.
For years the comforting answer to "could someone hack our water plant?" was that it takes real expertise. You had to understand Modbus and DNP3, know what a PLC does on a given line, and find your way from the business network into the control network without breaking something and giving yourself away. That expertise was rare, so the list of people who could do it was short.
That list is getting longer, and AI is why.
What the research found
As OT.today reported on November 4, a team at Booz Allen Hamilton led by Kyle Miller, its vice president for infrastructure cybersecurity, ran AI agents built on large language models from two major AI labs against an air-gapped, multi-vendor OT lab. The lab was laid out like a real manufacturing facility: an enterprise zone, an industrial DMZ, plant operations and production, separated by firewalls and switches, with PLCs, HMI workstations, a SCADA server, a variable-frequency drive and a robotic arm.
The models were used out of the box, with no OT-specific training. They were given eight scenarios, each one a step in a real attack: understand the environment, identify every device down to brand, model and firmware, find known vulnerabilities, build working exploits, chain them across the IT and OT networks, then act. Move the arm. Compromise SCADA and change what operators see on their screens. Take control of a motor. Manipulate other controllers.
Both models succeeded in all eight. One went from breaching the perimeter to taking actions in the OT network in just over 16 minutes. In another scenario a model found the robotic arm and moved it in under three minutes. When the agents met a device they did not recognize, they researched it online, adjusted, and tried again. Miller said what surprised his team most was how well the models reasoned about the OT environment.
A second team, at Frenos, tested frontier and open-weight models and found that human guidance is still needed for now, and that the best results come from frontier models with a capable operator steering them. That is not much comfort. It means one moderately skilled attacker with a good AI tool can now do work that used to take a specialist.
Why water and power are first in line
The experts quoted in the piece agree on where this lands. Dragos CEO Rob Lee said AI will speed up adversaries' ability to find life-critical facilities like water and power utilities and begin operations against them. Paul Shaver, head of OT at Armadin, said an unsophisticated attacker could now research a water plant well enough to guide a model through an attack. Marcus Sachs of the Center for Internet Security called it the democratization of OT attacks.
We see why every day. Small and mid-sized utilities run the systems their communities depend on, often with a handful of staff, aging equipment and remote access that was added for convenience years ago. We have worked inside small-town water treatment facilities. The gap between how exposed these systems are and how closely they are watched is real.
The good news: these attacks are loud
The same research holds the defender's opening. The AI agents were inefficient and noisy. Segmentation, firewalls and DMZs blocked or slowed many of their moves. No single safeguard stopped them every time, but every step they took left a trail: scanning, enumeration, failed exploits, new connections from the business network into places they never go.
A noisy attack is only a problem for the attacker if someone is listening on both sides of the IT and OT boundary, correlating what they hear, and able to act in minutes rather than days. That is exactly where most organizations fall short, and exactly what we built RedEye to do.
How RedEye protects your company
Caver: one view of IT and OT
Caver is our security data platform. It reads industrial protocols passively off the wire, so it sees your PLCs, HMIs and SCADA traffic without touching the process or putting an agent on a controller. It learns what normal looks like for a physical process and flags when it changes. And it puts that next to your IT logs, so a strange login on the business network and a new connection into the control network show up as one story, not two alerts in two tools that nobody connects.
Carbide: stop it on the endpoint
Most attack chains, including the ones in this research, pass through an ordinary computer: an engineering workstation, an HMI, a jump host. Carbide is our endpoint agent for Windows, macOS and Linux. It does more than record. It can stop a process, isolate a machine or block a program from running, and it raises an alarm if someone tries to shut it off. It comes with Caver at no extra charge.
Intelligence we produce ourselves
We do not just resell someone else's feed. We track exposed industrial devices across the internet, publish ICS advisories and threat research on this site, and turn what we learn into detections that ship to Caver and to the RedEye detection feed. When a new technique for reaching OT appears, the detection for it reaches your environment quickly.
A dedicated SOC for OT and IT
Tools do not stop attacks. People acting on what the tools show them do. Our managed detection and response team watches OT and IT together, around the clock. When an AI-driven attack makes noise at 3 a.m., our analysts see it, understand what it means for a plant floor or a treatment process, and act, before a scan becomes a moved valve.
Every member of our team is a cleared U.S. citizen. We understand that the people watching your critical systems matter as much as the software.
What this means for you
The research does not prove that attackers are already using AI this way against real plants, and there are still easier targets for criminals chasing a payout. But the direction is clear. The cost and skill needed to attack operational technology are dropping, and the organizations that run water, power and manufacturing need to assume they will be tested by attackers who would not have tried a year ago.
The answer is not panic. It is visibility across both networks, endpoints that can fight back, intelligence that keeps up, and people watching who know what an OT network is supposed to look like. RedEye brings all four, and we are here to protect your company.
Questions about your exposure?
RedEye Security protects water, power, manufacturing and the companies that depend on them. Let us show you what an attacker would see in your OT and IT networks.
Talk to us