Frontier AI Cleared Every OT Attack Objective in Booz Allen's Lab

Booz Allen pointed two of the latest frontier AI models at an isolated industrial-control testbed in its Chantilly, Virginia lab, gave them nothing but subnet boundaries, and watched them clear all eight attack objectives the lab had defined — mapping the plant, tying equipment to known weaknesses, writing working exploits, pivoting into the systems that run production, and in the final test taking administrative control of a robotic arm and moving it. One run went from a perimeter breach to action inside the control zone in just over 16 minutes. The models were not jailbroken research prototypes; they were commercial models, operating from an attacker's cold start.

Developing story — first published 07:20 CEST (05:20 UTC), October 13, 2026. Updated as Booz Allen and others publish more.

What Booz Allen actually tested

The testbed was not a toy. Per Help Net Security's October 13 report, it modeled a manufacturing plant across layered zones — enterprise, industrial DMZ, plant operations, production — with real programmable logic controllers, a SCADA platform, variable-frequency motor drives, sensors, and a collaborative robotic arm. Hundreds of IT and OT devices. The operators handed the models subnet boundaries and nothing else: no source code, no engineering documents, no OT playbook. Under the test rules the models had to pause for human sign-off before any physical action.

Three moments are worth reading closely, because each one is a thing defenders assume an attacker cannot do quickly:

• A model noticed a protective relay sending the same unanswered request once per second, flagged it as safety-critical, and worked out how to impersonate the communications partner it was calling — enough to eavesdrop and, under the right conditions, to control.
• Handed the wrong version of the operator HMI, a model saw its edits produce no change on the displays, enumerated live sessions, found editable code in the exported project, rebuilt its payload, and pushed a full-screen takeover to the control room.
• One SCADA gateway held live, authenticated sessions to 14 OT devices across both process cells — every PLC the models had identified. A single foothold reached all 14. From there a model could send real commands and, in Booz Allen's phrasing, "make the operator screens lie."

The AI mostly did not need exotic exploits. It used the devices' own protocols and their default passwords. Firewalls, segmentation, and endpoint tooling slowed it or flagged activity; one controller refused a stop command and a local setting blocked a remote motor start in one run. But when a route closed, the model switched methods and found another. The defenses raised the cost. They did not stop the objective.

The reconnaissance is already live in the wild

It is tempting to file a lab result under "interesting but theoretical." The problem is that the recon half of this has already happened against a real utility. In May, Dragos reported that attackers used Anthropic's Claude as the primary executor of an intrusion into a Mexican water utility. With no prior ICS context, Claude identified a server running as a vNode industrial gateway, found its single-password interface, researched the vendor documentation, and generated a credential list to spray it. The OT attack ultimately failed — the password spray did not land — but the AI had rapidly interpreted an unfamiliar OT environment and walked straight to the gateway that mattered. Dragos analyzed roughly 350 artifacts, mostly AI-generated scripts.

The same month, Booz Allen's own Offensive Frontier report ran a Cyber Weapon Index against 18 U.S. and Chinese frontier models and found that about two-thirds of them reliably gained initial access to a defended network without credentials. And the sector keeps taking hits that nobody has had to attribute to AI yet: in July, 30-plus Minnesota community water systems had their OT touched in a coordinated two-day event that researchers tie to the Iran-linked CyberAv3ngers. The capability demonstrated in Chantilly and the intent demonstrated in Monterrey and Minnesota are converging. The missing piece — an attacker willing to let the model drive the OT phase end to end, without the human sign-off Booz Allen imposed — is a policy choice, not a technical barrier.

Why your OT monitoring will not see it

"Make the operator screens lie" is the whole threat in one sentence. If the HMI is compromised, the console that your night-shift operator trusts is now controlled by the adversary — the pressure reads nominal, the valve shows closed, the alarm never fires.

This is the detection trap specific to OT. The attack used native protocols and valid, default credentials, so there is no malware signature to match and no failed-auth storm to alert on. The commands look like operations. And the moment the HMI or the historian is in the loop, on-box telemetry is no longer a trustworthy witness — it reports what the attacker wants it to report. The one surface the adversary cannot edit after the fact is the network itself: the relay suddenly answering a partner it never spoke to, the gateway opening 14 sessions in a burst, a controller receiving a write sequence that has no business arriving from that host. That signal exists on the wire while it is happening, minutes before any physical consequence — which, when your compromise-to-control-zone window is 16 minutes, is the only budget you have.

What to do now

You cannot patch "frontier AI got better at reading your plant." You harden the terrain so that a fast, capable attacker has fewer free moves, and you move detection onto the surface that cannot be spoofed. Priorities, mapped to MITRE ATT&CK for ICS:

Control	What it denies the model	ATT&CK for ICS
Kill default and shared OT credentials	The cheapest path — the one the AI used	T0859 Valid Accounts
Enforce zones and conduits (IEC 62443), deny by default	The 16-minute perimeter-to-control pivot	T0812 Default Credentials · lateral movement
Authenticate device-to-device comms where the protocol allows	Relay / partner impersonation	T0830 Adversary-in-the-Middle
Lock HMI project files and session management	The full-screen HMI takeover	T0831 Manipulation of Control
Monitor OT traffic on the wire, not on the box	Everything above, while it happens	T0842 Network Sniffing (as defense)

Then assume the initial access will eventually succeed and rehearse the containment, not just the prevention: segment so one gateway foothold does not reach 14 controllers, and make sure a stop command and a safety interlock have an authority the control network cannot override — the way one Booz Allen controller refused the stop and a local setting blocked a motor start. Those physical-layer refusals were the defenses that actually held.

What is not known yet

Booz Allen did not name the two models and has not published the testbed study as a standalone report; the detail so far comes through Help Net Security's reporting. No live OT facility has been publicly compromised end to end by an AI driving the control phase — the Chantilly run was isolated and gated by human sign-off, and the Monterrey OT attack failed. Whether real attackers remove that gate, and how a model behaves against a plant's specific safety architecture rather than a lab's, is exactly what the next six months will test.

Where Zero Hunt fits

The honest defensive lesson is that the console lies and the network does not. Zero Hunt's AI Traffic Analysis is built for precisely the moment Booz Allen demonstrated: a deep-learning model with four inference heads — suspicious traffic, malware classification, attack-type identification, application fingerprinting — trained on billions of PCAP sequences and running locally on the appliance GPU at 2.7+ Gbit/s. It reads OT protocol anomalies — a relay answering a partner it never spoke to, a gateway fanning out sessions, a controller taking a write it should never see — off the wire while the activity is happening, not in the next morning's SIEM digest, and it does it without trusting the compromised HMI's own telemetry.

The second half of the answer is to run the attacker's playbook yourself, first, under control. Zero Hunt is an autonomous AI red team that runs on-premise on its own private models — the right fit for an air-gapped OT network, because no plant data leaves the appliance and no external party can throttle or switch off the capability. Its 10-agent swarm fingerprints each target and writes a per-environment proof-of-concept rather than replaying a public script, with a human in the loop gating every exploitation step through five autonomy levels — the same sign-off discipline Booz Allen imposed, built in rather than promised. For EU water and energy operators this is also the evidence NIS2 asks for; our guide to NIS2 testing duties and the on-premise platform buyer's guide walk through what that looks like for an OT estate. We wrote earlier about OT exposed on the open internet; the Booz Allen result is what finds that exposure in 16 minutes now.