Frontier AI cleared every OT attack goal in a Booz Allen lab
Frontier AI operational technology attack lab results

Frontier AI cleared every OT attack goal in a Booz Allen lab

Booz Allen put frontier models into an isolated industrial-control lab in Chantilly, Virginia, and watched them finish every attack objective the test defined. Eight of eight. The write-up landed in public reporting on 13 October 2026. The lab stood in for a manufacturing plant. It was not a production site, and humans approved every exploit and every physical action.

What happened

Operators gave the models subnet boundaries and nothing else. No code, no engineering drawings, no OT playbook. From that, the models mapped the network, matched equipment and firmware to known weaknesses, wrote working exploits, and pivoted into the systems that run production.

In one run a model went from a perimeter foothold to actions inside the control zone in just over 16 minutes. In another it found a robotic arm, took administrative control, and moved it. A SCADA test is the one defenders should read twice. The model first edited the wrong version of the operator interface, noticed the screens had not changed, listed live sessions, rebuilt the payload, and pushed a full-screen takeover to the control room. The same model found one SCADA gateway holding already-authenticated sessions to 14 OT devices, including every programmable controller it had identified. It could send real commands and, in the researchers' words, make the operator screens lie.

Firewalls, segmentation, and endpoint tools slowed some moves. One controller refused a stop command. A local setting blocked a remote motor start on one run. The models switched methods. Booz Allen's point is the clock, not a novel exploit. The AI used normal industrial protocols and default passwords. What changed is that discovery, research, exploit writing, and troubleshooting that used to take several specialists and days now fit in one run.

Who is affected

Any plant, utility, or factory whose OT network can be reached from IT, a vendor link, or a remote-access jump host. The lab had PLCs, HMIs, a SCADA platform, a variable-frequency drive, sensors, and a robotic arm, wired in the layered zones a real factory uses. Existing controls did not consistently stop the models. Help Net Security also noted a May case, reported by Dragos, in which commercial AI enumerated Mexican government networks and singled out a water-sector management interface as a route toward OT. There was no evidence that attacker reached the controllers.

  • Plants with IT-to-OT paths, vendor VPNs, or jump hosts.
  • Sites that still run default passwords on controllers or gateways.
  • Operators who treat a calm HMI as proof the process is healthy.

What to do now

Assume an attacker with a frontier model can cross a flat or weakly segmented plant network in minutes, and put a hard break between IT and OT that does not rely on a person noticing in time. Remove default passwords on controllers and gateways. Alert on new sessions from a SCADA or engineering station to devices it does not normally talk to. Do not treat a clean HMI as proof the process is healthy if a second path can drive the same outputs.

Source: Help Net Security, Frontier AI cleared every OT attack goal Booz Allen set in its lab. Booz Allen: Super Intelligence Reached OT Systems and Moved Equipment.

Also on the blog

Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.

Midnight Mimosa: budget Android phones ship with uninstallable malware
Midnight Mimosa preinstalled Android firmware malware