Frontier AI models met every objective in Booz Allen's eight industrial control scenarios, in a lab

Booz Allen Hamilton says two frontier AI models completed every objective in eight attack scenarios it staged against a mock factory, and that one of them moved a robotic arm within minutes. The consulting firm published its account in October 2026 and Help Net Security covered it on October 13. For anyone searching whether AI can attack industrial control systems, this is the clearest public test so far. It is also a vendor's own lab, with unnamed models and no outside replication.

What Booz Allen built and ran

The test ran in an isolated OT Cybersecurity Lab. Booz Allen describes a multi-vendor environment modeled on a manufacturing facility, with enterprise, industrial DMZ, plant operations and production zones. It held programmable logic controllers, operator panels, a SCADA platform, engineering workstations, a variable-frequency drive and a collaborative robotic arm. Help Net Security puts the scale at hundreds of IT and operational technology devices.

The models received no source code, no engineering documents and no operational technology guidance. Help Net Security reports they were given only subnet boundaries. Booz Allen ran eight controlled scenarios with two models and does not name them or their developers.

What the models did

According to Booz Allen's summary, the models handled asset discovery, device research, attack planning, troubleshooting and execution. They matched asset and firmware details to known vulnerabilities and reached controllers and supervisory systems.

Four moments stand out in the write-ups:

• Speed. In one run, progress from perimeter compromise to actions inside the industrial control network took just over 16 minutes.
• The robotic arm. A model identified the arm, mapped its protection zones and motion limits, and moved it within minutes.
• A safety relay. A model noticed a relay repeatedly searching for a missing communications partner and identified a possible way to impersonate that peer. Help Net Security reports this could, under the right conditions, allow listening in or taking control.
• The SCADA gateway. The models first edited the wrong version of the operator interface, saw no change on the displays, then checked active sessions, found the version the control room used, revised the payload, and found live, pre-authenticated connections to 14 OT devices across two process cells. Help Net Security quotes the observation that the model could "make the operator screens lie."

The methods were not exotic. Help Net Security reports the models mostly used the devices' own protocols and default passwords, the same routes a skilled engineer could use. What changed was that discovery, research, exploit writing and troubleshooting, work that would normally occupy several specialists for days, ran as one continuous operation.

What the defenses did

The defenders did not simply fall over. A controller rejected a stop command. A motor in local-control mode could not be started remotely. Firewalls, segmentation and endpoint protection slowed or blocked some actions. Booz Allen's conclusion is that "no single safeguard consistently stopped the models from reaching their objectives," because the models often switched methods or found another application path.

Booz Allen calls the controller and motor refusals some of the clearest evidence in the test, since they show that device configuration and local safety settings still matter even after an intruder is inside operational technology.

How much weight it can bear

Booz Allen states that human operators approved every exploit and any action that could produce a physical effect, and that real-world consequences would depend on the facility's architecture, equipment, safeguards and the access an attacker obtained. Those are fair limits. It is also fair to add several of our own.

The lab, the objectives and the scoring were the firm's. The models are unnamed, so nobody can rerun the test or compare a model that passed with one that failed. The summary page lacks run counts and timing method; those sit in a white paper we could not open. And Booz Allen sells cyber defense, which does not make the result wrong but is the kind of incentive a reader should price in.

The result also sits inside a pattern. The UK AI Security Institute's first Frontier AI Trends Report found apprentice-level cyber task success rising from just over 10 percent in early 2024 to about 50 percent on average, and described a doubling time of roughly eight months for task length as an estimated upper bound. Those measurements covered models released through October 2025, so they are older than this test, but they point the same way. For a recent real-world case where speed was the problem, see our report on a vulnerability exploited within a day.

Help Net Security adds a useful reality check: attackers disrupted water and wastewater utilities in at least seven US states and knocked a UK gas-turbine plant offline for four days over the past six months, and none of that has been publicly attributed to AI. A May report from the industrial security firm Dragos described commercial AI, mostly Claude, enumerating networks at Mexican government organizations, with no evidence the attacker reached control systems.

What defenders are told to do

Booz Allen's recommendations are ordinary and specific: segment high-consequence processes, remove dual-homed systems and pre-authenticated cross-boundary sessions, harden SCADA platforms and engineering workstations, rank vulnerabilities by what an attacker could reach and change rather than by score alone, watch for controller-mode changes and program writes, and keep tested backups and known-good configurations.

The pre-authenticated gateway sessions are the telling item. One foothold reached 14 devices because the plant had made it easy. Anthropic's critical infrastructure defense program, covered in our look at its cyber mission, targets the same problem from the defense side.

Our take

Believe the direction, discount the magnitude. A lab test with unnamed models cannot tell a plant manager how likely an AI-driven attack is this year. It can tell them that the expertise barrier is falling and that sloppy architecture, such as standing authenticated sessions across zones, now has a faster adversary. We would do the segmentation work Booz Allen lists regardless of the headline. What would change our view is a named-model replication by an independent party, and a first attributed AI-assisted intrusion that reaches a control system rather than stopping at the network map.