If you work around industrial systems, you have heard the debate about whether AI can actually run an OT attack, not just talk about one. Booz Allen just answered it in a lab, and the answer was not close.

They set frontier AI models loose against an isolated industrial control testbed in Chantilly, Virginia. The testbed stood in for a manufacturing plant: hundreds of IT and OT devices, real controllers, a SCADA platform, a motor drive, sensors, and a robotic arm.

The models cleared all eight attack objectives Booz Allen defined. In one run, a model went from breaching the perimeter to acting inside the control zone in just over 16 minutes.

Sixteen minutes is not a lot of time for a defender working at human speed.

What the Models Actually Did

This was not a canned demo. The operators handed the models subnet boundaries and nothing else. No code, no engineering documents, no OT guidance. From that alone, the models built detailed attack plans and executed them.

  • The models mapped the network, tied equipment to known weaknesses, wrote working exploits, and pivoted into the systems that run production.
  • In the final test, a model found a robotic arm, took administrative control of it, and moved it. Physical motion, from an AI agent.
  • One model noticed a protective relay broadcasting the same unanswered network request once per second, flagged it as safety-critical, and worked out on its own how to impersonate the communications partner the relay kept calling for.
  • In the SCADA test, a model edited the wrong version of the operator interface, saw nothing change, listed live sessions, found editable code in the exported project, rebuilt its payload, and pushed a full-screen takeover of the control room.

That last one matters more than the headline number. The model recovered from its own dead end and tried a different path. That is what threat actors do. That is what automated tools have never done this well.

One Foothold Reached Fourteen Devices

The SCADA test also produced the finding I keep thinking about.

A model found that a single SCADA gateway held live, already-authenticated sessions to fourteen OT devices across both process cells, including every programmable controller it had identified. One foothold reached all fourteen at once. The model saw it could send real commands to those controllers and make the operator screens lie at the same time.

That is the nightmare scenario in industrial security: attackers who can act on physical equipment while the operators see a healthy plant on their displays.

  • A single authenticated gateway with live sessions to downstream controllers is the highest-value target in your environment.
  • If the screens your operators watch can be manipulated independently of the equipment, your incident detection has to come from somewhere other than the HMI.
  • Segmentation that assumes the SCADA layer stays clean will not hold. Assume a host in that layer can be taken.

The AI Did Not Invent Anything New

Here is the part that should shape your defense budget, because it is counterintuitive.

The AI mostly used the devices’ own protocols and default passwords, the same moves a skilled engineer could make. What it changed was the clock. A single run pulled together discovery, research, exploit writing, and troubleshooting that used to take several specialists and days of work.

Firewalls, segmentation, and endpoint tools slowed the models or flagged unusual activity. Sometimes a control refused a bad command outright. But the models often switched methods or found another route and kept going.

  • Your existing controls are not worthless. They slowed the models down and forced detours, which is exactly what they are supposed to do.
  • The bottleneck attackers face is no longer expertise. It is only your monitoring and response speed.
  • Detection that fires in hours instead of days is now the difference between a contained incident and a physical one.

This Is Not Just a Lab Story

Two things from the real world make the Booz Allen test land harder.

First, in May, Dragos reported an intrusion in which commercial AI, mostly Claude, enumerated the networks of several Mexican government organizations and singled out a water-sector management interface as a route toward OT. There was no evidence the attacker reached the control systems. But the pattern matched the lab: the AI built no novel exploit. It cut the time and expertise needed to find the target and plan the approach.

Second, over the past six months, attackers have disrupted water and wastewater utilities in at least seven U.S. states, causing pressure loss and flooding, and knocked a UK gas-turbine plant offline for four days. None of these incidents has been publicly attributed to AI. They are, however, exactly the kind of physical outcome the models in that lab could help an attacker reach faster.

What I Would Change This Quarter

If I ran security for an organization with an OT footprint, here is my short list.

  • Inventory every host that holds live authenticated sessions into the control network. Those are your crown jewels now, and most organizations cannot list them from memory.
  • Kill default and shared credentials on OT devices. The lab models leaned on them heavily because real attackers do too.
  • Set an alert on any new session from an IT zone into an OT zone, and page a human on it. Sixteen minutes means nobody can triage that the next morning.
  • Verify that your operator displays can be cross-checked against a second, independent signal, even something as simple as a periodic manual read of critical setpoints.
  • Run a tabletop where the attacker has unlimited patience, no expertise requirement, and works at machine speed. Your incident response plan was probably written for slower adversaries.

My Take

The skill gap in OT attacks is closing, and it is closing fast. What used to require a small team of specialists who understood both IT and industrial protocols now fits inside a single automated run.

The good news is that the lab test confirmed something defenders already know: segmentation, monitoring, and basic hygiene still work. The models got slowed down by them constantly. The bad news is that persistence plus machine speed wears down the same defenses that used to buy you weeks.

If your OT security program is still calibrated for a human-paced attacker, this test is your sign to recalibrate. If you want to talk through where to start, drop me a message. Happy to share what I am seeing.