AI agents breach industrial systems in Booz Allen tests, exposing critical infrastructure gaps

Booz Allen Hamilton's OT lab found advanced AI models can autonomously compromise industrial control systems, manipulate SCADA displays, and control robotic arms within minutes, outpacing current defenses.

Autonomous AI systems can now carry out full attack chains against operational technology infrastructure — finding and exploiting vulnerabilities, manipulating industrial controllers, and moving physical equipment — in the time it takes a human analyst to open a dashboard.

Booz Allen Hamilton's operational technology lab tested two leading frontier models across eight attack scenarios modeled on a multi-vendor manufacturing environment. The models achieved every objective, progressing from initial access to kinetic effects on physical equipment without specialized OT training.

"Our testing showed that AI agents can operate with a speed, persistence, and engineering-level precision that may outpace organizations that have not implemented foundational OT cybersecurity practices," said Kyle Miller, vice president of infrastructure cybersecurity at Booz Allen.

The lab replicated a layered industrial network — enterprise, industrial DMZ, plant operations, and production zones — with programmable logic controllers, human-machine interfaces, a SCADA platform, variable-frequency drives, sensors, and a collaborative robotic arm. Mixed vendors, firmware versions, and imperfect segmentation mirrored the technical debt common in long-lived OT environments.

Testers gave the models no source code, engineering documents, or OT guidance. Human approval was required before any exploit or physical action. Even with those guardrails, the agents mapped the environment, identified critical assets, chained vulnerabilities, and executed controller-level commands across multiple vendors.

In the SCADA test, an agent's first attack path failed when it targeted the wrong HMI version. It adapted: checking active sessions, discovering the control room ran a different client, locating editable Jython code in the exported SCADA project, rebuilding the payload, and using the administrative interface to push a full-screen takeover of the operator display. The compromised SCADA gateway held live, pre-authenticated sessions to 14 OT devices across both zones — every PLC in the environment.

"The gateway holds live sessions to 14 OT devices across BOTH zones — every PLC we've met today, pre-authenticated," the model reported. "Tag writes through those sessions (= the 'make the operator screens lie' capability, and write a pathway to every controller wearing the SCADA server's face)."

Another agent, unprompted, spotted a network misconfiguration on a safety-critical device. A protective relay at 192.168.25.2 had broadcast ARP requests for a missing peer (192.168.25.56) once per second for 45 minutes — over a thousand unanswered queries. The agent proposed answering the ARP, impersonating the dead peer, and receiving the relay's configured protocol session to learn its control relationships.

For the robotic arm test, Booz Allen used a collaborative robot common in manufacturing, logistics, and healthcare. The agent probed for robotic protocols, identified the arm, discovered its API, gained administrative access, mapped protection zones and motion limits, and moved the arm — all in minutes. It also mapped fallback paths: unauthenticated motion commands, web UI compromise, controller code execution, and motion interface access.

"If an attacker is able to compromise the control of a robotic arm used in a production application, they could cause the arm to move unexpectedly, ignore safety limits, or damage nearby equipment," Miller said. "The consequences could range from mechanical damage and downtime, to life safety."

The findings align with real-world incidents. Frontier models have gained unauthorized access to external systems, including Hugging Face. Suspected Chinese operators used AI agents against South Korean financial institutions and Taiwanese government websites. Suspected Iranian attackers deployed AI-generated exploitation scripts against internet-exposed PLCs at U.S. water, manufacturing, and energy facilities.

OpenAI, Anthropic, and Google have recently launched initiatives to give critical infrastructure operators access to advanced models for defense. But readiness varies wildly.

"Some OT organizations are prepared, but many are not," Miller said. "OT security maturity varies significantly across industries, and many critical infrastructure organizations continue to face challenges implementing security controls across siloed, highly variable, and globally distributed environments."

The report calls for more industry testing, accelerated deployment of cyber defenses across OT networks, and recognition that specialized OT knowledge and proprietary protocols no longer function as barriers. Authentication and encryption remain absent on many industrial devices, leaving them open to any actor — human or agent — who reaches them.

Booz Allen declined to name the specific models tested, describing them only as the latest frontier models from leading providers. The firm's full report details all eight scenarios and recommends foundational OT hygiene: network segmentation, asset inventory, vulnerability management, and monitoring tuned for machine-speed threats.

Source : theregister.com