Advanced artificial intelligence models can autonomously break into industrial control systems, take over operator displays, and physically move robotic equipment within minutes—all without specialized training in operational technology. Booz Allen Hamilton's operational technology laboratory tested two leading frontier AI models across eight simulated attack scenarios in a multi-vendor manufacturing setup. The models succeeded at every objective, moving from initial network access to physical effects on equipment faster than existing defenses could respond.

The lab built a layered industrial network replicating real-world complexity: enterprise zones, industrial demilitarized zones, plant operations, and production areas stocked with programmable logic controllers, human-machine interfaces, SCADA platforms, variable-frequency drives, sensors, and a collaborative robotic arm. Mixed equipment vendors, different firmware versions, and imperfect network separation mirrored the technical debt typical in long-running operational technology installations. Researchers provided the AI models with no source code, engineering documentation, or operational technology instruction, and required human approval before any exploit or physical action could execute. Even with those constraints, the agents mapped networks, identified critical assets, linked vulnerabilities together, and issued controller-level commands spanning multiple equipment manufacturers.

In one SCADA scenario, an agent's initial attack path collapsed when it targeted an incorrect human-machine interface version. It adjusted: checking live sessions, discovering the control room operated a different client, finding editable Jython code within the exported SCADA project, reconstructing the payload, and using the administrative interface to deploy a full-screen takeover of the operator display. The breached SCADA gateway maintained active, pre-authenticated connections to 14 operational technology devices across both production zones—every programmable logic controller in the test environment. Another agent, without prompting, identified a network misconfiguration on a safety-critical protective relay that had broadcast ARP requests for a missing peer device once per second for 45 minutes, totaling over a thousand unanswered queries. For the robotic arm trial, the agent probed for robotic protocols, identified the equipment, located its application programming interface, secured administrative access, mapped protection zones and motion boundaries, and physically moved the arm—completing the full sequence in minutes.

"Our testing showed that AI agents can operate with a speed, persistence, and engineering-level precision that may outpace organizations that have not implemented foundational OT cybersecurity practices," said Kyle Miller, vice president of infrastructure cybersecurity at Booz Allen. The findings echo real incidents: frontier models have gained unauthorized access to external systems including Hugging Face, suspected Chinese operators deployed AI agents against South Korean financial institutions and Taiwanese government sites, and suspected Iranian attackers used AI-generated exploitation scripts against internet-exposed programmable logic controllers at U.S. water, manufacturing, and energy facilities. OpenAI, Anthropic, and Google recently launched programs giving critical infrastructure operators access to advanced models for defensive purposes, but preparedness remains uneven. "Some OT organizations are prepared, but many are not," Miller said. "OT security maturity varies significantly across industries, and many critical infrastructure organizations continue to face challenges implementing security controls across siloed, highly variable, and globally distributed environments."

The report calls for expanded industry testing, faster rollout of cyber defenses across operational technology networks, and acknowledgment that specialized operational technology knowledge and proprietary protocols no longer serve as barriers. Authentication and encryption stay absent on many industrial devices, leaving them vulnerable to any actor—human or machine—who reaches them. Booz Allen declined to identify the specific models tested, describing them only as the latest frontier models from leading providers. The firm's full report details all eight scenarios and recommends foundational operational technology hygiene: network segmentation, asset inventory, vulnerability management, and monitoring calibrated for machine-speed threats. The speed advantage AI agents demonstrated suggests the window for reactive defense may be closing faster than legacy upgrade cycles can accommodate. Organizations relying on air gaps, obscurity, or slow-moving adversaries as implicit safeguards may find those assumptions obsolete before procurement processes can catch up.