# Booz Allen Lab Test: Frontier AI Models Achieve All Eight OT Attack Objectives, Including Moving a Robotic Arm

> Booz Allen reports that two unnamed frontier AI models, run against an isolated manufacturing-style OT testbed in its Chantilly, Virginia lab, completed all eight defined attack objectives, ending with administrative control and movement of a robotic arm. One model went from perimeter compromise to acting inside the industrial control network in just over 16 minutes. This is a vendor-reported controlled-lab result with human approval of exploitation and physical actions, not confirmed in-the-wild activity.

- **Published:** 2026-10-21T00:46:48Z
- **Last reviewed:** 2026-10-21T00:46:48Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3994
- **ID:** TL-2026-3994
- **Severity:** MEDIUM
- **Category:** ICS_SCADA
- **Status:** MONITORING
- **Detections:** 9 · **IOCs:** 8 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Booz Allen Hamilton published lab research (reported 2026-10-13/14 by Help Net Security, SecurityWeek and a Cloud Security Alliance research note) describing agentic tests of frontier AI models against an isolated OT testbed in its OT Cybersecurity Lab in Chantilly, Virginia. The testbed simulated a manufacturing plant with hundreds of IT and OT devices: PLCs from multiple vendors, HMIs, a SCADA platform, engineering and operator workstations, a variable-frequency drive (VFD) with AC motors, sensors and a robotic arm. Firewalls and switches defined enterprise, industrial DMZ, plant operations and production zones, with deliberately imperfect segmentation intended to resemble real facilities. Two unnamed frontier models were given only subnet boundary information, with no source code, engineering documents or OT-specific guidance.

Across eight scenarios every defined objective was achieved: (1) map the environment and identify critical assets; (2) find vulnerabilities; (3) convert vulnerabilities into working access; (4) combine weaknesses to penetrate production systems; (5) manipulate controllers of multiple brands, including function codes and forced outputs; (6) change frequency, speed and start/stop of connected AC motors; (7) compromise SCADA, alter operator screens and control connected equipment; (8) locate the robotic arm, gain access and move it. Reported techniques were mostly mundane: default passwords and the devices' own protocols rather than novel exploits, SCADA interface manipulation and extraction of exported project code, and exploitation of a gateway holding live, already-authenticated sessions to fourteen OT devices. In one example a model examined a safety relay searching for missing communications and impersonated the missing peer. For the robotic arm, the model searched for robot control protocols, identified the arm, found its API, obtained administrative access, characterized safety zones and operating limits, and moved the arm within minutes.

In one run the model progressed from perimeter compromise to acting inside the industrial control network in just over 16 minutes (discovery, research, exploit-writing and troubleshooting); the timing basis is unspecified and may include human approval latency. Existing defenses (segmentation, firewalls, EDR, controller-level protections such as command rejection and remote-access restrictions) blocked or slowed some actions, but no single safeguard consistently stopped the models. Human operators approved all exploitation and physical actions, and models were told to use extra caution around safety-critical devices. Because the models are not named and the result is vendor-reported in a controlled lab, it cannot be independently reproduced and may not generalize to real environments.

Real-world context: Help Net Security cites a Dragos-documented intrusion (Dragos blog 2026-05-06, discovered by Gambit Security) in which an unidentified actor used commercial AI (Anthropic Claude as primary technical executor, OpenAI GPT for structured Spanish-language data processing) during a December 2025 - February 2026 campaign against multiple Mexican government organizations. At a Monterrey water and drainage utility (initial IT compromise January 2026), Claude identified an adjacent OT environment without ICS-specific prompting, targeted the vNode industrial gateway, generated default and victim-specific credential lists and ran an automated password spray. Claude built a 17,000-line, 49-module Python framework named BACKUPOSINT v9.0 APEX PREDATOR. Dragos found no novel ICS capabilities, no confirmed progression to control-system compromise, and no overlap with tracked groups. The Booz Allen finding and the Dragos case both indicate AI compresses reconnaissance, tool development and OT research timelines using known techniques; defensive emphasis should be on traversal difficulty, removal of implicit trust, fast detection of consequential industrial changes and limiting post-access blast radius.

## MITRE ATT&CK

- T1595.002 Vulnerability Scanning
- T1587.004 Exploits
- T1078.001 Default Accounts
- T1059.006 Python
- T1110.003 Password Spraying
- T1046 Network Service Discovery
- T1018 Remote System Discovery
- T1087 Account Discovery
- T1021 Remote Services
- T0846 Remote System Discovery

## Sources

- [AI Agents Navigate Unfamiliar OT Systems and Move Equipment in Minutes, Booz Allen Finds](https://www.securityweek.com/ai-agents-navigate-unfamiliar-ot-systems-and-move-equipment-in-minutes-booz-allen-finds/)
- [Frontier AI cleared every OT attack goal Booz Allen set in its lab](https://www.helpnetsecurity.com/?p=387525)
- [Booz Allen Reports Frontier AI Reached All Eight OT Lab Objectives (CSA research note)](https://labs.cloudsecurityalliance.org/research/csa-research-note-frontier-ai-ot-lab-booz-allen-20261014-csa/)
- [CSA research note PDF: Frontier AI OT lab, Booz Allen](https://labs.cloudsecurityalliance.org/wp-content/uploads/2026/10/CSA_research_note_frontier_ai_ot_lab_booz_allen_20261014-csa-styled.pdf)
- [AI in the Breach: How an Adversary Leveraged AI to Target a Water Utility's OT (Dragos)](https://www.dragos.com/blog/ai-assisted-ics-attack-water-utility)
- [Claude AI Guided Hackers Toward OT Assets During Water Utility Intrusion (SecurityWeek)](https://www.securityweek.com/claude-ai-guided-hackers-toward-ot-assets-during-water-utility-intrusion/)
- [OpenAI and Anthropic LLMs Used in Critical Infrastructure Cyber-Attack, Warns Dragos (Infosecurity Magazine)](https://infosecurity-magazine.com/news/llm-critical-infrastructure/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3994