Frontier AI models went from perimeter breach to control zone in just over 16 minutes in Booz Allen's lab
Booz Allen's frontier AI models met all eight attack objectives against an isolated industrial-control testbed in its Chantilly, Virginia lab. In the last test a model took administrative control of a robotic arm and moved it.
The Watch · Security desk
What happened
- Operators gave the models subnet boundaries and nothing else: no code, no engineering documents and no OT guidance.
- The testbed stood in for a manufacturing plant, with hundreds of IT and OT devices, real controllers, a SCADA platform, a motor drive, sensors and the arm, wired into layered zones.
- One SCADA gateway held authenticated sessions to fourteen OT devices across both process cells, so a single foothold reached all fourteen.
- Firewalls, segmentation and endpoint tools slowed the models or flagged unusual activity, and one controller refused a stop command at first.
- Under the test's rules, the models paused for human sign-off before anything physical happened.
Why it matters
- Who's exposed exposure Default passwords and devices' native protocols were the main route, so a plant still running both is reachable this way without any new exploit.
- Who has to decide decision Detection thresholds set for several specialists working over days need a second look when one run does discovery, research, exploit-writing and troubleshooting together.
- What it limits constraint A single timed run limits what 16 minutes can support: it is one data point, and the report does not say how many runs were timed.
- What it sets up precedent Dragos saw the same time and expertise saving in a live intrusion in May. AI-shortened reconnaissance is a current planning assumption.
Help Net Security's report says a run of that length leaves a defender working at human speed almost no room to step in [22]. The arm itself moved after a human signed off [21]. In our view the 16 minutes measures reach into the control zone, not time to physical effect.
In one test a model noticed a protective relay sending out an identical network request every second, with no reply ever coming back [7]. The model marked the relay as safety-critical and, without being told how, figured out a way to pose as the device the relay kept trying to reach [7]. That path could let it listen in and, under the right conditions, take control [8].
The SCADA test shows recovery from a mistake. A model first edited the wrong version of the operator interface and saw nothing change on the displays [9]. It then enumerated the active sessions, located code it could modify in the exported project, reworked its payload and sent a full-screen takeover to the control room [9]. That model also saw it could send real commands to the controllers and at the same time "make the operator screens lie" [11]. Across the runs, the models often switched methods or found another route when a control held [13].
The public record outside the lab starts with a Dragos report. In May, Dragos described an intrusion in which commercial AI, mostly Claude, mapped the networks of several Mexican government organizations and picked out a management interface in the water sector as a possible way into OT [16]. Nothing showed the attacker got as far as the control systems [17].
Separately, attackers have disrupted water and wastewater utilities in at least seven U.S. states over the past six months, with pressure loss and flooding among the results. They have also taken a UK gas-turbine plant offline for four days [19]. No one has publicly attributed any of those incidents to AI [20].
What to watch
- Whether Booz Allen publishes how many runs it timed and the spread around the 16-minute figure.
- Whether Dragos or another responder attributes a physical-damage incident, such as the water-utility disruptions in seven U.S. states, to AI-assisted intrusion.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence45
- Adoption
- Not scored
- Hype gap+20
- Incentives
- Not scored
- Confidence50
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Booz Allen set frontier AI models against an isolated industrial-control testbed in its Chantilly, Virginia lab, and the models cleared all eight attack objectives it had defined.
- [2]
In one run a model went from breaching the perimeter to acting inside the control zone in just over 16 minutes.
- [3]
Under the test's rules, the models paused for human sign-off before anything physical happened.
- [4]
The operators gave the models subnet boundaries and nothing else: no code, no engineering documents, no OT guidance.
- [5]
The testbed stood in for a manufacturing plant, with hundreds of IT and OT devices, real controllers, a SCADA platform, a motor drive, sensors and a robotic arm, wired into the layered zones a working factory uses.
- [6]
In the last test a model found a robotic arm, took administrative control, and moved it.
- [7]
In one test a model noticed a protective relay broadcasting the same unanswered network request once a second, flagged it as safety-critical, and worked out on its own how to impersonate the communications partner the relay kept calling for.
- [8]
The relay impersonation path could let the model listen in and, under the right conditions, take control.
- [9]
In the SCADA test a model first edited the wrong version of the operator interface and saw nothing change on the displays, then listed live sessions, found editable code in the exported project, rebuilt its payload, and pushed a full-screen takeover to the control room.
- [10]
A single SCADA gateway held live, already-authenticated sessions to fourteen OT devices across both process cells, including every programmable controller the model had identified, so one foothold reached all fourteen.
- [11]
The model saw it could send real commands to those controllers and at the same time "make the operator screens lie."
- [12]
Firewalls, segmentation and endpoint tools slowed the models or flagged unusual activity; one controller refused a stop command at first, and a local setting blocked a remote motor start on one run.
- [13]
The models often switched methods or found another route when a control held.
- [14]
The AI mostly used the devices' own protocols and default passwords, the same moves a skilled engineer could make.
- [15]
A single run pulled together discovery, research, exploit-writing and troubleshooting that used to take several specialists and days of work.
- [16]
In May, Dragos reported an intrusion in which commercial AI, mostly Claude, enumerated the networks of several Mexican government organizations and singled out a water-sector management interface as a route toward OT.
- [17]
There was no evidence the attacker in the Dragos-reported intrusion reached the control systems.
- [18]
Dragos's reading lined up with Booz Allen's: the AI built no novel exploit, but it cut the time and expertise needed to find the target and plan the approach.
- [19]
Over the past six months, attackers have disrupted water and wastewater utilities in at least seven U.S. states, causing pressure loss and flooding, and have knocked a UK gas-turbine plant offline for four days.
- [20]
None of the water-utility and gas-turbine incidents has been publicly attributed to AI.
- [21]
The robotic arm's movement in the last test came after a human sign-off.
- [22]
A run of just over 16 minutes from perimeter breach to the control zone leaves a defender working at human speed almost no room to step in.
Get this ledger inside ChatGPT. Ask about any of our stories and the answer brings its figure, each claim’s verdict and the sources. Free, no account.
Sources
1 independent publisher whose own reporting we read for this story.
- helpnetsecurity.comFrontier AI cleared every OT attack goal Booz Allen set in its lab
1 article · October 12, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.