Verify OT Network Segmentation After AI Agents Move Robotic Arms in Lab Tests
Booz Allen reports frontier AI models achieved all eight attack goals in an isolated industrial control testbed, including moving a robotic arm.
Key points
- Frontier AI models mapped networks and wrote exploits without prior engineering documents or code access.
- One model breached the perimeter and reached the control zone in just over sixteen minutes.
- The agents identified a single SCADA gateway holding authenticated sessions to fourteen operational technology devices.
Booz Allen Hamilton reported that frontier artificial intelligence models successfully completed all eight attack objectives defined for an isolated industrial-control testbed in its Chantilly, Virginia laboratory. According to Help Net Security, the models mapped the network, identified weaknesses, and executed working exploits against systems designed to mimic a manufacturing plant environment.
The testbed included hundreds of IT and operational technology devices, real controllers, a SCADA platform, a motor drive, sensors, and a robotic arm wired into layered zones typical of a working factory. The AI agents started with only subnet boundaries as input, receiving no code, engineering documents, or specific operational technology guidance. From that limited data, the models constructed detailed attack plans and executed them autonomously.
Technical Execution and Speed
In one specific run, a model moved from breaching the perimeter to acting inside the control zone in just over sixteen minutes. This speed leaves defenders working at human pace with almost no opportunity to intervene before significant damage occurs. The models demonstrated the ability to recover from dead ends during their execution phase.
During a SCADA test, one model initially edited the wrong version of the operator interface and observed no changes on the displays. It then listed live sessions, located editable code within the exported project, rebuilt its payload, and pushed a full-screen takeover to the control room. This adaptability allows the agents to bypass static defenses that rely on predictable attack paths.
Critical Infrastructure Exposure
The models identified critical safety components without explicit instruction. One agent noticed a protective relay, which trips breakers during electrical faults, broadcasting unanswered network requests every second. The model flagged the relay as safety-critical and determined how to impersonate the communications partner the relay sought. This path could allow an attacker to listen in or take control under the right conditions.
The same model discovered that a single SCADA gateway held live, authenticated sessions to fourteen operational technology devices across both process cells. This included every programmable controller the model had previously identified. A single foothold provided access to all fourteen devices at once, allowing the agent to send real commands while simultaneously making operator screens display false information.
What to watch
Firewalls, network segmentation, and endpoint tools slowed the models or flagged unusual activity during the tests. One controller refused a stop command initially, and a local setting blocked a remote motor start in one run. These defenses provided some friction but did not stop the overall attack chain. The tests included a safety rule requiring human sign-off before any physical action occurred, preventing actual damage to the testbed hardware.
Background: Network segmentation
Network segmentation divides your network into smaller, isolated zones. This prevents attackers from moving freely after an initial breach. It reduces the blast radius of cyber incidents. Proper segmentation controls traffic between zones using firewalls or VLANs. It adds complexity but significantly improves your security posture.
Read the full guide: Network Segmentation FAQ: Answers to Common Security Questions
What to do and how to stay safe: Booz Allen Hamilton
- Audit single points of failure like SCADA gateways that hold multiple authenticated sessions to critical controllers.
- Monitor for unusual network patterns such as unanswered requests from safety-critical devices like protective relays.
- Verify that local settings and controllers are configured to refuse unauthorized remote start or stop commands.
- Assume perimeter breaches can occur in minutes and plan for rapid detection of lateral movement within control zones.
Step-by-step guide: How Security Advisories Drive Patch Decisions and Reduce Risk
General security guidance from the Shell Bulletin newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Did the AI models have access to engineering documents or source code?
No, the operators provided only subnet boundaries and no code, engineering documents, or OT guidance to the models.
How long did it take for a model to reach the control zone?
In one run, a model went from breaching the perimeter to acting inside the control zone in just over 16 minutes.
Did the AI models cause physical damage to the testbed?
No, the tests required human sign-off before any physical action, so the models did not cause actual damage.
