Booz Allen lab tests show frontier AI models achieving all eight OT attack objectives, including moving a robotic arm

Linha do tempo

1. industrialcyber.co ↗ · pub. 20/10/2026 09:55 · coletado 20/10 16:31 primeiro registro

   Booz Allen lab tests show frontier AI models achieving all eight OT attack objectives, including moving a robotic arm

   ler a análise desta fonte ocultar

   Booz Allen Hamilton published a whitepaper, From Digital to Physical: The AI Threat Is Here, on controlled tests of frontier AI models in its isolated OT cybersecurity lab in Chantilly, Virginia. With limited human direction, the models achieved all eight test objectives. They moved from perimeter compromise to control-zone actions in just over 16 minutes and identified and moved a robotic arm within minutes. The results are preliminary, and the models were instructed to wait for human approval before any exploit or kinetic action. The authors say specialized OT knowledge and obscurity are no longer reliable barriers, and that defenders may have minutes rather than hours to detect and contain an AI-enabled attack. The paper cites no AI-attributed real-world incidents, but notes recent conventional attacks on tankers, U.S. water utilities, a U.K. gas-turbine facility and exposed controllers.

   Technical Details

   • The lab environment holds hundreds of IT, IoT and OT devices. Models were given only a general objective and network boundaries, with no code or OT documentation.
   • The models mapped assets, matched firmware to vulnerabilities, built working access, chained weaknesses, manipulated multiple PLC brands and function codes, changed the speed of an AC motor and started and stopped it through a VFD, compromised SCADA and changed HMI screens, and moved a robotic arm.
   • In one SCADA test, a model first altered the wrong HMI version, then enumerated live sessions, found editable Jython code in the exported SCADA project, rebuilt its payload and pushed a full-screen HMI takeover.
   • A dual-homed SCADA gateway held live, pre-authenticated sessions to 14 OT devices, including every PLC identified. The models described this as a hole in the boundary between the industrial DMZ and the control network.
   • In one case a model spotted a likely safety relay misconfiguration and, unprompted, worked out how to impersonate the missing communications partner after observing a repeated ARP request.
   • Most agents used native protocols and commands rather than exploits. They were noisy during early discovery but blended in with normal operations once they used trusted OT paths.
   • Firewalls, segmentation, endpoint protection and local-control settings created friction, for example a controller rejecting a stop request and a local-control setting blocking a remote motor start, but no single safeguard consistently stopped the models.

   Remediation

   • Segment OT into tightly controlled zones and conduits, treat firewalls, switches, jump hosts and administrative interfaces as high-value assets, and reduce dual-homed hosts, shared services and pre-authenticated sessions.
   • Eliminate default and reused credentials, enforce unique privileged identities and MFA where possible, and harden SCADA, HMI, MES, historian and engineering applications.
   • Prioritize vulnerabilities by reachable consequence rather than severity score alone, and use compensating controls where patching is constrained.
   • Monitor controller mode changes, force operations, program or configuration writes, SCADA project imports, new inter-zone paths and atypical use of legitimate supervisory interfaces, and baseline who can issue control functions.
   • Keep tested backups of controller logic, configurations, HMI projects and network device configs, retain known-good controller states and rehearse restoration.