AI agents in Booz Allen's OT lab reached an industrial control network in about 16 minutes
Booz Allen says AI agents met every objective in eight OT lab scenarios, reaching an industrial control network in little more than 16 minutes. The researchers warn that the window to prepare is closing, but the tests ran only in the firm's own isolated lab.
The Watch · Security desk
A model found a robotic arm and moved it within minutes. Agents had no source code or engineering documents. Defenses slowed some actions; no single safeguard consistently stopped them. The whitepaper says they undermine security through obscurity. Owners are told to remove implicit trust.
- capability A model in one test Found a robotic arm, mapped its protection zones and motion limits, and moved it within minutes, claim 7
- constraint The AI agents Had no source code, no engineering documents and no advanced OT guidance for the OT in question, claim 1
- constraint Existing defenses Blocked or slowed some actions; no single safeguard consistently stopped the models, claim 8
- exposure Many OT environments Whitepaper says the models undermine the 'security through obscurity' approach they relied on, claim 12
- decision Owners and operators Told to make environments hard to traverse, remove implicit trust and detect industrial changes quickly, claim 13
| Who | How | Kind | Claim |
|---|---|---|---|
| A model in one test | Found a robotic arm, mapped its protection zones and motion limits, and moved it within minutes | capability | 7 |
| The AI agents | Had no source code, no engineering documents and no advanced OT guidance for the OT in question | constraint | 1 |
| Existing defenses | Blocked or slowed some actions; no single safeguard consistently stopped the models | constraint | 8 |
| Many OT environments | Whitepaper says the models undermine the 'security through obscurity' approach they relied on | exposure | 12 |
| Owners and operators | Told to make environments hard to traverse, remove implicit trust and detect industrial changes quickly | decision | 13 |
What happened
- In a second test, a model located a robotic arm, worked out its protection zones and motion limits, and had the arm moving within minutes.
- The agents started with no source code, no engineering documents and no advanced OT guidance for the systems they were tested against.
- Defenses already in place blocked or slowed some of the actions, but none of them on its own reliably kept the autonomous models from their objectives.
- Booz Allen's findings were presented last week at SecurityWeek's ICS Cybersecurity Conference in Nashville, ahead of the public release.
Why it matters
- capability In the lab, the models did asset discovery, device research and attack planning, work that usually spans several people, so an intruder in these tests needed no team of OT specialists.
- exposure Plants that count on attackers not understanding their equipment lose that cover. The whitepaper says the models undermine the security-through-obscurity approach many OT environments have relied on.
- decision Booz Allen tells owners to spend less effort predicting each form of AI attack. It points them toward making environments hard to traverse, removing implicit trust, detecting industrial changes quickly and limiting what an intruder can affect.
The whitepaper puts the change in terms of speed. "We have long understood that non-kinetic cyber actions can produce kinetic effects. What has changed is the speed and precision with which these models can help produce those kinetic effects," it says [11]. Traversal is the part the lab timing measures. In the fastest test, models moved from a perimeter compromise to actions inside the industrial control network [6].
The researchers warn that the window to prepare is closing [14]. SecurityWeek's account describes lab tests and does not include a date for that window or an incident outside the lab [2]. The lab is Booz Allen's own, and SecurityWeek called its OT environment a reasonable representation of enterprise OT, though not necessarily identical to it [3]. We think the result establishes capability once an agent has a foothold. A forecast of when attackers use that capability against real plants would need evidence from outside the lab.
Booz Allen's summary line says "frontier super intelligence navigated unfamiliar industrial systems, adapted when blocked, and moved physical equipment within minutes" [4]. SecurityWeek found the term confusing and noted that it follows Donald Trump's September 29, 2026 executive order to replace the term artificial intelligence with super intelligence in the executive branch [15]. SecurityWeek assumed the firm means the improving capabilities of contemporary AI [17]. The tests used frontier models, and in our view the label does not change what the lab results show [2]. SecurityWeek asked Booz Allen to clarify the terminology and had received no response at the time of writing [16].
What to watch
- Whether the public Booz Allen whitepaper names the frontier models and describes how each of the eight scenarios was scored.
- Booz Allen's reply to SecurityWeek on what 'super intelligence' means in the report.
- Any replication of these results on OT equipment outside Booz Allen's lab, or an incident report that matches the lab sequence.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence40
- Adoption
- Insufficient
- Hype gap+25
- Incentives
- Insufficient
- Confidence45
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
The agents were given no prior knowledge of the OT in question: neither source code, nor engineering documents, nor advanced OT guidance.
- [2]
Booz Allen examined the effect of AI agents on OT using AI frontier models within its own isolated OT lab.
- [3]
The firm's OT environment is not necessarily identical to enterprise OT, but it is a reasonable representation.
- [4]
Booz Allen's report says "frontier super intelligence navigated unfamiliar industrial systems, adapted when blocked, and moved physical equipment within minutes."
- [5]
Across eight scenarios, every defined test objective was achieved.
- [6]
It took little more than 16 minutes for models in one test to move from a perimeter compromise to actions inside an industrial control network.
- [7]
In another test, a model found a robotic arm, mapped its protection zones and motion limits, and moved it within minutes.
- [8]
Within the tests, existing defenses blocked or slowed some actions, but no single safeguard consistently stopped the autonomous models from achieving their objectives.
- [9]
The report's findings were presented last week at SecurityWeek's Industrial Control Systems (ICS) Cybersecurity Conference in Nashville, ahead of the public release.
- [10]
The researchers said the models connected work that usually spans multiple people and stages, including asset discovery, device research, attack planning.
- [11]
The full whitepaper says: "We have long understood that non-kinetic cyber actions can produce kinetic effects. What has changed is the speed and precision with which these models can help produce those kinetic effects."
- [12]
The whitepaper says the models also undermine the 'security through obscurity' approach on which many operational technology environments have long relied.
- [13]
The researchers say owners and operators should focus less on predicting every form of frontier AI use in an attack and more on making their environments difficult to traverse, removing implicit trust, detecting consequential industrial changes quickly, and limiting what an attacker can affect after gaining access, whether through cyber or physical means.
- [14]
The researchers warn that the window to prepare is closing.
- [15]
SecurityWeek found Booz Allen's use of 'super intelligence' confusing and noted it follows Donald Trump's September 29, 2026 Executive Order to replace the term 'Artificial Intelligence' with 'Super Intelligence' in the executive branch.
- [16]
SecurityWeek reached out to Booz Allen for clarification on the terminology but had received no response at the time of writing.
- [17]
SecurityWeek assumes Booz Allen is using 'super intelligence' to indicate the improving capabilities of contemporary artificial intelligence rather than a new type of AI.
Get this ledger inside ChatGPT. Ask about any of our stories and the answer brings its figure, each claim’s verdict and the sources. Free, no account.
Sources
1 independent publisher whose own reporting we read for this story.
- securityweek.comAI Agents Navigate Unfamiliar OT Systems and Move Equipment in Minutes, Booz Allen Finds
1 article · October 14, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.