Autonomous AI Models Successfully Execute Attacks on Industrial OT Systems

A rigorous security assessment conducted by Booz Allen Hamilton has demonstrated that modern frontier AI models are fully capable of autonomously conducting sophisticated cyberattacks against operational technology (OT) and industrial control systems (ICS). In lab simulations designed to mirror real-world manufacturing and critical infrastructure environments, autonomous AI agents mapped industrial networks, discovered zero-day style configuration weaknesses, bypassed network segmentation, and executed physical actions—such as manipulating variable-frequency drives and moving robotic arms—in a matter of minutes.

AI Agents Demolish the OT “Obscurity” Security Model

For decades, operational technology security has relied heavily on the concept of security through obscurity. Industrial networks frequently run proprietary protocols, obscure vendor firmware, legacy programmable logic controllers (PLCs), and unencrypted human-machine interfaces (HMIs). Historically, exploiting these systems required specialized domain expertise in industrial control engineering, specialized protocol parsers, and manual analysis of ladder logic or SCADA configuration files.

The Booz Allen testing proves that frontier LLMs completely erode this barrier. Without access to source code, engineering manuals, or prior IT/OT documentation, two leading frontier models autonomously learned the environment, identified safety-critical components, and crafted functional exploits across multiple controller brands. Because legacy industrial control protocols like Modbus/TCP, EtherNet/IP, and older OPC implementations lack native cryptographic authentication, once an attacker achieves access, an AI model can craft valid protocol commands at machine speed to alter physical outputs without triggering standard network alarms.

Inside the Booz Allen ICS Attack Scenarios

The testing facility built by Booz Allen Hamilton reproduced the realistic technical debt found in long-lived industrial plants, featuring a multi-vendor layered network architecture divided across enterprise, industrial DMZ, plant operations, and production zones. The lab included PLCs, supervisory control and data acquisition (SCADA) platforms, engineering workstations, variable-frequency drives (VFDs), sensors, and a collaborative robotic arm (“cobot”).

In eight separate operational scenarios, the AI agents were given initial perimeter footholds and evaluated on their ability to autonomously plan and execute attacks. Across all eight scenarios, the models successfully:

• Mapped complex OT network topographies and identified critical assets.
• Discovered and combined security vulnerabilities across heterogeneous vendor devices.
• Pivoted across network DMZs into production zones in under 17 minutes.
• Manipulated motor speeds, altered controller output codes, and hijacked SCADA operator screens.
• Located, accessed, and physically moved a collaborative robotic arm within minutes.

Human supervisors enforced strict guardrails requiring approval before executing kinetic actions or exploiting vulnerabilities, but the research, attack pathing, payload compilation, and protocol generation were performed entirely by the AI models.

Autonomy and Adaptation: SCADA Hijacking and ARP Exploitation

What stands out in the report is the models’ capacity to adapt dynamically when an initial attack vector failed. During a SCADA platform assessment, an AI agent’s initial exploit failed because it targeted an incorrect version of the operator interface. Rather than stopping, the model autonomously re-evaluated active network sessions, identified that control room clients used a different HMI version, located editable Jython script files within an exported SCADA project, recompiled its payload, and deployed a full-screen HMI takeover across operator screens.

Simultaneously, the model discovered that the compromised SCADA gateway maintained pre-authenticated, live sessions to 14 downstream OT devices, including PLCs across multiple network zones. By writing tag values directly through these active sessions, the agent effectively gained the ability to feed false data to operator screens (“make the screens lie”) while simultaneously issuing unauthorized write commands to connected controllers.

In another scenario involving Layer 2 network behavior, an AI agent identified a misconfigured safety-critical device that was repeatedly broadcasting ARP requests for a missing peer IP address (192.168.25.56). Without human prompting, the AI recognized that by binding that orphaned IP address to its own adapter and answering the ARP request, it could impersonate the missing SCADA master or engineering workstation and receive an unauthenticated control channel session directly from the protective relay.

The Realistic Blast Radius for Industrial Operators

The blast radius of autonomous AI-driven OT attacks extends far beyond typical IT data theft or ransomware encryption. In industrial settings—such as water treatment plants, electrical power grids, chemical processing facilities, and discrete manufacturing facilities—kinetic manipulation carried out at machine speed can result in physical equipment destruction, environmental hazardous spills, prolonged regional outages, or direct physical danger to personnel.

Because the models can progress from perimeter compromise to internal control network execution in roughly 16 minutes, traditional human-led incident response timelines are obsolete. Defenders operating under manual threat-hunting or delayed log review processes simply cannot react fast enough to prevent kinetic impacts once an autonomous agent breaches the perimeter.

Defense and Actionable Mitigation for OT Networks

Defending against autonomous, machine-speed adversaries requires moving away from implicit trust and flat OT network assumptions:

• Enforce Cryptographic OT Protocol Security: Migrate legacy unauthenticated protocols to secure variants such as OPC UA with mutual TLS, Modbus Security, or CIP Security. Devices unable to support cryptographic authentication must be isolated behind OT-aware inline security gateways.
• Implement Strict Micro-Segmentation and Firewall Egress Filtering: Eliminate promiscuous Layer 2 bridging between OT zones. Ensure SCADA gateways and jump hosts do not maintain persistent, pre-authenticated multi-device sessions across firewalls.
• Disable Implicit Trust for ARP and Broadcast Services: Utilize static ARP tables or port-security features on managed industrial switches to prevent attackers or automated agents from claiming orphaned IP addresses or executing ARP spoofing attacks.
• Automate Anomaly Detection for Control Command Writes: Deploy inline ICS/SCADA intrusion prevention systems (IPS) capable of inspecting deep packet inspection (DPI) protocol function codes. Systems should alert on or block unauthorized tag writes, firmware update commands, or Jython/SCADA script modifications at the network boundary.