These results come from vendor research by Booz Allen Hamilton, a government and defense contractor, and have not been independently verified.

What Happened

Booz Allen Hamilton ran eight controlled attack scenarios in its isolated OT Cybersecurity Lab, according to a report it published Oct. 8 that The Register covered. The lab modeled a manufacturing plant with enterprise, industrial DMZ, plant operations and production zones, including programmable logic controllers, operator screens, a SCADA platform, a motor drive and a collaborative robot arm.

The models received no source code, engineering documents or advanced OT guidance, and human operators approved every exploit and any action with a physical effect. Booz Allen says the models met every test objective. In one scenario, they moved from a perimeter compromise into the industrial control network in just over 16 minutes. In another, a model mapped the robot arm's protection zones and motion limits and moved it within minutes.

In the SCADA test, the models first targeted the wrong version of the operator interface, then found live, pre-authenticated connections to 14 OT devices. Booz Allen declined to name the models, describing them only as two recent frontier models from leading AI providers.

RelatedWhite House AI Task Force Plans Breach Warnings From Labs at Its First Meeting

Why It Matters

The timescale is the central finding: response plans that assume hours of warning may not hold. The Register noted that many OT devices lack authentication or encryption.

Some protections worked. A controller rejected a stop command, and a motor in local control could not be started remotely. Firewalls, segmentation and endpoint protection slowed or blocked some actions, though no single control consistently stopped the models.

Kyle Miller, Booz Allen's vice president of infrastructure cybersecurity, said the tested robot arm can operate without a safety cage. “Some OT organizations are prepared, but many are not,” he told The Register. Booz Allen's report recommends segmenting around high-consequence processes, removing connections that cross security boundaries and watching for controller-mode changes and program writes.

Context

The Register linked the findings to AI agents used in real intrusions, an August federal warning about AI-generated code targeting internet-exposed PLCs at U.S. facilities, and recent defender-focused steps by OpenAI, Anthropic and Google.

What to Watch

Open questions include which models were used and how results would change without human approval of each exploit, whether CISA or sector regulators cite the findings in guidance for plant operators, and whether AI developers add specific limits on industrial targeting.

Sources