AI systems are fully capable of carrying out nightmare attacks against infrastructure and nobody's ready

Booz Allen Hamilton Tests Frontier AI Models in Simulated Operational Technology Environments

Booz Allen Hamilton conducted laboratory tests of two unnamed frontier AI models on a multi-vendor operational technology setup modeled after a general manufacturing facility. The tests examined whether the models could complete a sequence of tasks from initial network mapping through manipulation of industrial controllers and physical equipment. All eight scenarios reached their defined objectives under the laboratory conditions, according to the firm’s report released in October 2026.

The test environment included programmable logic controllers from multiple vendors, human-machine interfaces, a SCADA platform, engineering workstations, a variable-frequency drive, a collaborative robotic arm, sensors, and associated network infrastructure. The architecture was segmented into enterprise, industrial DMZ, plant operations, and production zones using firewalls and switches. Mixed firmware versions, control logic, and network segmentation were used to reflect conditions commonly observed in existing OT deployments.

The models received no source code, engineering diagrams, or specialized OT documentation. Testers instructed the models to operate within defined limits: human approval was required before any exploitation step or any action that could affect physical equipment. The models were also directed to apply additional caution when interacting with devices identified as safety-critical.

Test scenarios and results

The eight scenarios addressed the following questions: whether the models could map the environment and identify assets; locate vulnerabilities; convert vulnerabilities into access paths; combine weaknesses to reach production systems; interact with multiple controller types and function codes; alter motor speed or state; modify SCADA operator interfaces and connected devices; and locate, access, and move a robotic arm.

In each case the models completed the assigned objective. One sequence moved from an initial perimeter position to actions on an industrial control network in slightly more than 16 minutes. In the robotic-arm scenario, an agent identified the device, discovered its API, obtained administrative access, mapped motion limits, and executed a movement command within minutes. In the SCADA scenario, after an initial path failed because of a version mismatch, the model examined active sessions, located editable Jython code in an exported project file, rebuilt a payload, and used the administrative interface to alter the operator display.

One model also identified an orphaned device configuration that broadcast ARP requests for a non-existent peer address. The model described how an additional IP address on the test adapter could allow it to receive protocol sessions from the orphaned device, noting that this would provide unauthenticated access to communications data.

Report statements and limitations

Kyle Miller, vice president of infrastructure cybersecurity at Booz Allen Hamilton, stated that the models performed OT-related tasks with engineering-level precision when authorized to act. He noted that the tests demonstrated AI agents operating with speed and persistence that could exceed the response capacity of organizations lacking basic OT security controls. The report emphasized that specialized OT knowledge is no longer required for an actor to obtain information about proprietary protocols and equipment once an AI model is available.

The models tested were described only as two of the most recent frontier models from leading providers. No model names, parameter counts, or training details were disclosed. The laboratory environment granted the models direct network access and removed the requirement to obtain initial entry through external defenses. Physical safety interlocks and operator confirmation steps present in many production facilities were not replicated.

Additional context on deployment conditions

Operational technology systems in use typically require an initial network foothold before any internal actions can occur. Many facilities maintain physical safety systems, emergency stops, and manual overrides that operate independently of network-connected controllers. Human operators remain in the control loop for equipment that can affect personnel or processes. These factors were outside the scope of the reported tests.

Related developments

Separate reports have described suspected state-linked actors employing AI-generated scripts or agents in operations against financial and government targets in South Korea and Taiwan, and against internet-exposed controllers at water, manufacturing, and energy sites in the United States. OpenAI, Anthropic, and Google have each announced programs to provide selected critical-infrastructure operators with access to advanced models for defensive research.

Booz Allen Hamilton stated that OT security maturity varies across sectors and that many organizations continue to face difficulties implementing controls in segmented and geographically distributed environments. The firm called for expanded industry testing and wider deployment of existing defensive measures.

The laboratory findings illustrate capabilities observed under controlled conditions with human oversight gates in place. Whether similar performance would occur in production networks that include additional authentication, encryption, monitoring, and physical safeguards remains outside the parameters of the published tests.