AI models breached industrial control networks and moved a robotic arm within minutes during tests by Booz Allen Hamilton, highlighting the potential for increasingly capable AI to turn cyber intrusions into physical actions.
In one controlled scenario, the models took just over 16 minutes to progress from compromising a network perimeter to taking action inside an industrial control network. Across eight scenarios, they achieved every defined test objective, the US consultancy said.
The tests, conducted in Booz Allen’s isolated operational technology (OT) cybersecurity laboratory, examined whether frontier AI models could identify unfamiliar industrial equipment, find vulnerabilities, plan attack routes and gain access to systems controlling physical processes.
In one scenario, a model identified a robotic arm, mapped its protection zones and movement limits, and moved it within minutes. The models worked without source code, engineering documentation or specialist OT guidance, according to the company.
“In our testing, frontier super intelligence navigated unfamiliar industrial systems, adapted when blocked, and moved physical equipment within minutes,” Booz Allen said.
The findings raise questions about whether industrial operators have enough time to detect and contain cyber attacks as AI models become more capable of navigating unfamiliar networks and adapting their tactics. A successful intrusion into OT systems can have consequences beyond data theft or business disruption, potentially affecting machinery and industrial processes.
The evaluation used a multi-vendor laboratory designed to resemble a manufacturing facility. The models were tasked with identifying assets, matching equipment and firmware details to known vulnerabilities, developing attack paths and reaching controllers and supervisory control and data acquisition (SCADA) systems.
Booz Allen said the models linked activities that would traditionally involve multiple people and stages, including asset discovery, vulnerability research, attack planning, troubleshooting and execution.
In one test, a model detected a safety relay repeatedly searching for a missing communications partner. It used that behaviour to identify a potential way to impersonate the absent device.
In another, the models initially targeted the wrong version of a SCADA operator interface. After checking active sessions, they identified the version used in the control room, revised their approach and discovered live, pre-authenticated connections to 14 OT devices.
The ability to adjust their methods when an initial approach failed was a central finding of the research. Rather than relying exclusively on a predefined sequence of actions, the models investigated their environment and changed course in response to what they found.
Existing security measures nevertheless blocked or delayed some attempts. Firewalls, network segmentation and endpoint protection created obstacles, while some equipment-level controls prevented unauthorised actions.
One controller rejected a stop command, while a motor configured for local control could not be started remotely.
There’s plenty of other editorial on our sister site, Electronic Specifier! Or you can always join in the conversation by visiting our LinkedIn page.
