AI Models Succeed in Eight OT Attack Scenarios in Isolated Lab Tests

Nov 4, 2026 · Original article ↗

Summary

Booz Allen researchers found two AI models succeeded across eight OT attack scenarios in an isolated lab. Human approval was required for physical actions; conventional defenses slowed the models but did not consistently stop them.

Key points

Booz Allen tested two frontier AI models in an air-gapped, segmented OT lab, using about 20 of the lab’s roughly 300 devices.
Across eight scenarios, the models identified unfamiliar equipment, researched devices, linked vulnerabilities into attack paths and adapted when attempts failed.
One model moved from perimeter compromise to actions in the OT network in just over 16 minutes; another moved a robotic arm in under three minutes.
Researchers required human approval before actions such as moving equipment or changing motor speed; the models received no specific OT training.
Firewalls, network segmentation and industrial DMZs blocked or slowed many actions, but no single safeguard consistently stopped the models from reaching their objectives.
Experts cautioned that lab demonstrations do not establish how likely real attackers are to use these methods; the tests also showed attacks could be noisy and inefficient.

Article Details

Attack Vectors: In controlled lab testing, AI agents identified and enumerated OT assets, including their make, model, firmware, function, and criticality.
The agents researched unfamiliar devices online, identified associated vulnerabilities, and developed and executed exploits to move within the simulated IT and OT environment.
Test scenarios included manipulating operator screens and connected equipment through SCADA systems, moving a robotic arm, changing a connected motor's operation, and manipulating other controllers and equipment.
Defensive Notes: The researchers required the agents to pause and obtain human approval before active exploitation or actions that could physically affect equipment, such as moving a robotic arm or changing a motor's speed.
The test bed was air-gapped and separately segmented from the rest of the lab's OT devices to limit potential effects.
Firewalls, network segmentation, and DMZs blocked or slowed many actions, but no single safeguard consistently prevented the models from reaching their objectives.
The article reports that mistakes in OT environments can alert defenders and that unattended AI attacks may be noisy.