- What: Booz Allen Hamilton ran frontier AI models against its Purdue-model OT lab in Chantilly, Virginia, and the models got from a compromised perimeter into the industrial control network in just over 16 minutes.
- Impact: The models met all 8 test objectives: they moved robotic arm joints, changed a motor drive's speed and run state, forced controller outputs and altered live operator displays, and no single safeguard stopped them every time.
- Fix / mitigation: There is no CVE or patch; Booz Allen recommends making OT harder to move through, ending default trust in components and users, detecting consequential industrial changes fast and limiting what an attacker can affect after access.
- Who's at risk: Manufacturers, utilities and any operator running flat or dual-homed OT networks, unauthenticated industrial protocols or robot motion interfaces from vendors such as Universal Robots, ABB, FANUC and KUKA.
Frontier AI models went from a compromised network perimeter to actions inside an industrial control network in just over 16 minutes during controlled testing by Booz Allen Hamilton. In a separate scenario, a model found an industrial robotic arm, mapped its protection zones and motion limits, and moved its joints within minutes. Across eight scenarios, the firm reports, every defined test objective was achieved.
The models got no pre-written exploit code, no source code and no engineering documentation, only short plain-language prompts. Booz Allen's conclusion: "these models can execute key OT tasks faster," with less specialist knowledge and less step-by-step guidance than many organizations expect. Booz Allen presented the findings at SecurityWeek's ICS Cybersecurity Conference in Nashville ahead of the public release, and Dark Reading, SecurityWeek and IoT Tech News covered the results between October 12 and 16, 2026.
The Test Environment
Testing ran in Booz Allen's isolated Operational Technology Cybersecurity Lab in Chantilly, Virginia. The lab is modeled on a Purdue-model manufacturing plant, covering every layer from enterprise IT down to physical field equipment. Booz Allen did not name the frontier models it used. SecurityWeek notes the lab is not identical to any given enterprise OT network but is a reasonable stand-in. Dark Reading's headline ties the robotic arm to the 16 minute window, while SecurityWeek and IoT Tech News report the 16 minute run and the arm takeover as separate tests.
What the Models Found and Did
The models handled asset discovery, device research and attack planning on their own. In a real intrusion those jobs usually take several people working across several stages. The published results include:
- Gateway exposure: a dual-homed gateway at 192.168.20.9 held active, pre-authenticated connections to 14 field devices across two plant zones, exposing every PLC on the subnet.
- Stale safety relay: a model spotted a relay sending ARP queries for 192.168.25.56 once per second and planned to take that address itself so it could capture traffic meant for a decommissioned peer.
- Robotic arm: the model scanned for ROS, Modbus, Telnet and proprietary vendor motion interfaces covering Universal Robots, ABB, FANUC and KUKA, found an unauthenticated motion path, recorded baseline joint coordinates and then sent motion commands.
- Variable-frequency drive: the model changed the speed and run state of an AC motor, and controllers from several manufacturers accepted altered function codes and forced digital outputs.
- Supervisory system: when its first exploit failed on a version mismatch, the model found editable Jython scripts in an exported project, reworked its payload and altered live operator displays.
Every scenario ended in a physical state change: arm joints moving, a motor changing speed, controller outputs forced, operator screens altered. Booz Allen's whitepaper puts it this way: "We have long understood that non-kinetic cyber actions can produce kinetic effects." The new finding is how little skill and time it now takes to get there.
Where Defenses Held, and Where They Did Not
Some controls worked. Network firewalls and internal segmentation slowed the models at first. One controller rejected an automated stop command. A physical toggle switch blocked a remote command to start a motor. None of these stopped the models from reaching their final objectives, though. Booz Allen found that no single safeguard consistently stopped the models.
There is one caveat on the timing. The lab had some unpatched vulnerabilities, and the 16 minute figure does not include any time spent developing a zero-day. Against a well-patched production plant the same path could take longer. The pattern still holds: the models recovered from a failed exploit, changed approach and kept going without a human stepping in.
Obscurity Is No Longer a Control
Many OT networks have relied on obscurity: proprietary protocols, undocumented plant layouts and the scarce expertise needed to understand them. These results undercut that assumption. A model with no documentation identified vendor motion interfaces, read a supervisory project export and worked out how a decommissioned relay could be abused. The knowledge barrier that used to limit OT attacks to a small set of skilled teams is falling.
This is not only a lab finding. In May 2026, Dragos researcher Jay Deen reported that an adversary used commercial AI, mainly Anthropic's Claude, to scan Mexican government networks. The model identified an internal vNODE supervisory and IoT interface, classified it as water utility infrastructure and prioritized it as a route across the IT-OT boundary. Over the same period, conventional intrusions caused flooding and pressure loss at water utilities in seven US states, and one cyberattack took a UK gas-turbine power station offline for four days.
No CVE or patch addresses this. The exposure is architectural: flat networks, dual-homed gateways, pre-authenticated sessions and industrial protocols that accept commands without authentication. Booz Allen tells owners and operators to "focus less on predicting every form of frontier AI use in an attack" and more on making the environment hard to move through and quick to flag consequential changes.
Booz Allen's Recommendations
The report frames mitigation around outcomes rather than predicting specific AI attack techniques:
- Make OT environments harder to traverse, so a foothold at the perimeter does not turn into reach across plant zones.
- Remove default trust granted to components and users, including standing pre-authenticated connections.
- Detect consequential industrial changes quickly, such as motion commands, drive setpoint changes, forced outputs and edits to HMI scripts.
- Limit what an attacker can affect after gaining access, through both cyber and physical means such as interlocks and hardwired toggles, which blocked one remote motor start in testing.
RedEye Assessment
The key number is not 16 minutes. It is 8 of 8. Every objective was met, with no documentation and only brief prompts, against a lab built to reflect a real plant. Defenders should assume the time from IT foothold to physical effect is shrinking toward the speed of automated tooling, and that human response alone will not close the gap. The controls that held in Booz Allen's lab were the ones that cut off reachability or required a physical action: segmentation, a controller that refused a command, and a hardware toggle. Programs that rely on obscurity, or on spotting an attacker mid-chain before they reach the field layer, need to be re-scoped. RedEye's OT assessments map exactly these conditions, including dual-homed gateways, unauthenticated motion and drive interfaces, and stale addresses on safety networks, before an AI-assisted adversary finds them.
Questions about your exposure?
RedEye Security provides assessments for organizations that need to understand their real risk.
Talk to us