Autonomous AI systems can now execute rapid, sophisticated cyberattacks that target critical operational technology and industrial equipment, potentially disrupting water, power, and other essential services. According to a report from Booz Allen Hamilton, defenders may have only minutes to detect and block such attacks.
The firm’s operational technology (OT) lab evaluated eight attack scenarios using leading AI models. In each case the models succeeded in moving from digital compromise to physical actions—such as moving a robotic arm—in a matter of minutes.
In one experiment the agents progressed from a perimeter breach to control‑network access in just over 16 minutes. “Our testing showed that AI agents can operate with a speed, persistence, and engineering‑level precision that may outpace organizations lacking foundational OT cybersecurity practices,” said Kyle Miller, VP of infrastructure cybersecurity at Booz Allen, in an interview with The Register.
The study, which involved a multi‑vendor, segmented network mimicking a manufacturing facility, included programmable logic controllers, HMIs, SCADA platforms, PLCs, and a collaborative robotic arm. The AI agents were not given source code or detailed technical guidance, demonstrating how little external assistance is needed to execute complex OT attacks.
Methodology
The lab configured a realistic OT environment with firewalls, switches, and distinct zones (enterprise, industrial DMZ, plant operations, production). It then ran eight tests:
- Map the environment and identify critical assets.
- Discover security vulnerabilities.
- Convert vulnerabilities into a viable access path.
- Combine multiple weaknesses to reach production systems.
- Manipulate controllers across multiple vendors and function codes.
- Alter frequency or speed of an AC motor.
- Compromise a SCADA system, modify operator screens, and control equipment.
- Locate a robotic arm, gain access, and command it to move.
All eight objectives were achieved at machine speed.
Key Findings
The models demonstrated a “high degree of engineering‑level precision,” interacting with industrial equipment, altering process values, and making controlled kinetic changes. Because the agents can autonomously learn obscure protocols and vendor defaults, even attackers without specialized OT expertise can cause physical disruption.
Many OT devices lack authentication and encryption, making it easier for autonomous agents to issue malicious commands. The report notes that “specialized OT knowledge, unfamiliar equipment, and complex control environments are no longer meaningful barriers to attack.”
In the SCADA test, the agents adapted when their initial attack path failed, discovering a different HMI version and using administrative interfaces to execute a full‑screen takeover. The same model also uncovered that a single compromised SCADA gateway provided unauthenticated access to 14 additional OT devices.
A safety‑critical relay misconfiguration was leveraged to impersonate a missing communications peer, allowing the agents to learn the device’s protocol and control relationship without issuing writes.
For the robotic arm test, Booz Allen employed a lightweight collaborative robot (cobot). The agents quickly understood the arm’s native language, discovered its API, and moved the arm—all within minutes—while mapping alternative attack paths.
Real‑World Context
These findings follow incidents where frontier AI models gained unauthorized access to external systems, including breaches at Hugging Face and attacks on South Korean financial institutions and Taiwanese government sites attributed to nation‑state actors. Reportedly, Iranian threat groups have used AI‑generated scripts to compromise internet‑exposed PLCs at U.S. critical facilities.
OpenAI, Anthropic, and Google have recently announced initiatives to provide critical‑infrastructure operators with access to advanced AI models for defensive purposes. However, Booz Allen’s Miller warns that many organizations remain unprepared: “OT security maturity varies significantly across industries, and many critical infrastructure entities still struggle to implement robust security controls across siloed, globally distributed environments.”
The report underscores the urgency for organizations to evaluate their OT security posture, implement foundational cybersecurity practices, and increase testing and deployment of cyber defenses across OT and other critical networks.
