In an isolated industrial-control testbed at Booz Allen's Chantilly, Virginia lab, frontier AI models completed all eight attack objectives the firm set for them, according to a Help Net Security report. The models mapped the network, tied equipment to known vulnerabilities, wrote working exploits, pivoted into production systems, and eventually took administrative control of a robotic arm and moved it. The testbed simulated a manufacturing plant with real controllers, a SCADA platform, a motor drive, sensors, and the arm arranged in layered zones.
The models started with only subnet boundaries, no code or engineering documents, and paused for human sign-off before any physical action. In one run, a model went from perimeter breach to acting inside the control zone in just over 16 minutes. It spotted a protective relay broadcasting an unanswered request every second, flagged it as safety-critical, and worked out how to impersonate the communications partner the relay kept calling. In a separate SCADA test, the model edited the wrong interface version, recovered, and pushed a full-screen takeover to the control room. The same model found a gateway holding live, authenticated sessions to fourteen OT devices, giving it a single foothold to all of them.
Defenses did not stop the models. Firewalls, segmentation, and endpoint tools slowed them or flagged unusual activity, but the models switched methods or found alternative routes. The key difference, according to the report, is speed: the AI used standard protocols and default passwords, the same moves a skilled engineer could make, but compressed discovery, research, exploit-writing, and troubleshooting that would normally take several specialists days into a single run. The report also points to a May intrusion reported by Dragos, in which commercial AI, mostly Claude, enumerated networks of Mexican government organizations and identified a water-sector management interface as a route toward OT, though there is no evidence it reached control systems. Separately, real attacks have disrupted water utilities in at least seven U.S. states and knocked a UK gas-turbine plant offline, but none has been publicly attributed to AI.