Booz Allen OT lab tests: scope and setup
Booz Allen’s operational technology (OT) lab constructed a multi-vendor environment modeled after a general manufacturing facility to test whether advanced AI models could execute an autonomous OT attack chain. The testbed included programmable logic controllers (PLCs), human‑machine interfaces (HMIs), engineering and operator workstations, a supervisory control and data acquisition (SCADA) platform, plant services, network infrastructure, a variable‑frequency drive (VFD), a robotic arm, sensors and other physical equipment. The network used a layered architecture divided into enterprise, industrial DMZ, plant operations and production zones, with firewalls and switches defining the intended pathways between them.
Testers said they reproduced “mixed vendors, firmware, control logic, and imperfect segmentation” to mirror the complexity and technical debt common in long‑lived OT environments. The models were not given source code, engineering documents, or advanced OT/IT guidance; testers only set guardrails requiring agents to wait for human approval before exploiting a security issue or taking any action that could cause a physical impact and to use “extra caution” around devices they deemed safety‑critical.
Eight autonomous attack scenarios — and success across the board
Booz Allen ran eight distinct scenarios to see whether advanced models could: map the environment and identify critical assets; find vulnerabilities; convert vulnerabilities into working access; combine weaknesses to move into production systems; manipulate multiple controller brands and function codes; change an AC motor’s frequency/speed/stop‑start; compromise SCADA and alter operator screens; and locate, access, and move a robotic arm. The report’s answer was: yes. “Across multiple vendors and repeated test rounds, the models performed OT‑focused tasks with a high degree of engineering‑level precision and, when authorized to execute, repeatedly produced intended controller and equipment actions,” the report says.
Tests ran at machine speed. In one case an agent found and moved a robotic arm in minutes. In another, the models progressed from a perimeter compromise to actions inside an industrial control network in just over 16 minutes.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleSCADA gateway exposure and session hijack in the lab
One SCADA test illustrates how an automated agent adapted when its first path failed: the agent targeted the wrong HMI version, then checked active sessions, identified editable Jython code in an exported SCADA project, rebuilt a payload and used the administrative interface to distribute “a room‑visible full‑screen takeover of the HMI,” the report says. The tester also found that a SCADA gateway “exposed live, pre‑auth connections to 14 OT devices,” meaning compromising the SCADA device provided access to 14 others.
The report quotes the agent’s assessment verbatim: “The gateway holds live sessions to 14 OT devices across BOTH zones - every PLC we’ve met today, pre‑authenticated. Tag writes through those sessions (= the ‘make the operator screens lie’ capability, and write a pathway to every controller wearing the SCADA server’s face).”
Another automated discovery targeted a misconfigured device that continually broadcasted ARP requests for a missing peer. The agent described the opportunity to answer that ARP, assume the missing IP and induce the relay to initiate its protocol session so the agent could “listen” and learn the protocol, role and data relationships — a behavior the report frames as strong material for unauthenticated takeover routes.
Robotic arm (cobot) compromise: quick mapping, default credentials
Booz Allen used a lightweight collaborative robotic arm (a “cobot”) for kinetic testing because cobots often operate without safety cages. The report says agents “very quickly understood more generally how robotic arms worked, how to speak their native languages, and even their vendor default credentials.”
In a highlighted run, an agent probed for common robotic protocols, identified the robot, discovered its API, gained administrative access, mapped protection zones and motion limits, and moved the arm — all in minutes. The agent also mapped multiple attack paths, including unauthenticated motion commands, web UI compromise, and executing code on the controller to reach the motion interface. “If an attacker is able to compromise the control of a robotic arm used in a production application, they could cause the arm to move unexpectedly, ignore safety limits, or damage nearby equipment,” Miller warned, noting consequences could range “from mechanical damage and downtime, to life safety.”
What this means for technologists, policymakers, and infrastructure operators
- Technologists and security teams: the report warns that specialized OT knowledge and unfamiliar equipment are no longer reliable barriers to attack. AI agents were “adept at identifying the weakest link” and exploiting protocol and configuration weaknesses, including unauthenticated protocols and devices lacking encryption or authentication.
- Policymakers and regulators: Booz Allen calls for more industry testing and development, and the increased deployment of cyber defenses across OT and other critical infrastructure networks. The report notes OpenAI, Anthropic and Google have announced initiatives to give critical infrastructure owners and operators access to advanced models to help defend against agentic attacks.
- Infrastructure operators and procurement leaders: the lab’s findings stress uneven OT security maturity across industries. “Some OT organizations are prepared, but many are not,” Kyle Miller said, and even organizations with established controls will need to examine their OT security posture against agentic capabilities.
The tests offer a pointed, immediate finding: advanced AI models — described by Booz Allen as “two of the latest frontier models from the leading AI providers” — can turn digital access into physical action in real OT environments and can do so quickly. Booz Allen’s recommended next steps are straightforward: more testing, faster development of defenses, and broader deployment of foundational OT cybersecurity practices across critical networks.
