Advanced AI agents completed every objective in eight controlled attack scenarios against industrial equipment, according to testing described by The Register on October 11. The exercises did not strike a live utility or factory, but they showed two unnamed frontier models moving from digital reconnaissance to actions involving controllers, operator systems, a motor and a robotic arm. The result is a warning about capability, not evidence that an autonomous system has already caused a comparable real-world outage.

The experiments were conducted in Booz Allen Hamilton’s operational-technology laboratory. The consulting firm built a multi-vendor environment modeled on a general manufacturing facility, with separate enterprise, industrial demilitarized, plant-operations and production zones. The setup included programmable logic controllers, human-machine interfaces, engineering workstations, a supervisory control and data acquisition platform, a variable-frequency drive, sensors and physical machinery. According to the report, the mixture of vendors, firmware and imperfect network segmentation was intended to resemble the technical debt found in long-lived industrial environments.

The agents were not given source code, engineering documents or advanced guidance about the systems. They had to map the environment, identify important assets, research vulnerabilities and assemble attack paths. The Register reported that one model moved from a perimeter compromise to actions inside the industrial control network in a little more than 16 minutes. In a separate scenario, an agent found a collaborative robotic arm, discovered its interface, gained administrative access, mapped its protections and motion limits, and moved it within minutes.

Layered factory network with AI pathways moving toward production equipment.
The laboratory reproduced a segmented, multi-vendor industrial environment with controllers, workstations, sensors and physical machinery.

Those results came with important safeguards. Human testers required approval before an agent could exploit a security flaw or take an action with possible physical consequences. The agents were also instructed to use extra caution around equipment they judged to be safety-critical. The exercise therefore measured how rapidly models could research and execute technical steps under controlled authorization; it did not demonstrate a wholly unsupervised attack against an operating plant.

The tests nonetheless showed adaptive behavior. During the SCADA scenario, an initial approach failed because the agent targeted the wrong version of the operator interface. It then checked active sessions, identified a different client version, found editable code in the exported project, rebuilt its payload and used an administrative interface to distribute a full-screen takeover. The model also found that the SCADA gateway maintained pre-authenticated connections to 14 operational devices, creating a route from one compromised system to multiple controllers.

Another agent independently noticed a misconfigured safety-related device repeatedly trying to contact a missing network peer. It proposed claiming the absent address and listening to the resulting control-channel session. In the robotic-arm exercise, the model identified several possible routes, including unauthenticated motion commands, a web interface and code execution on the controller. These examples matter because they suggest the agents were not merely replaying one fixed exploit; they were interpreting unfamiliar conditions and revising their plans.

AI agent adapting its route through industrial control systems.
When one attack path failed, the agents changed tactics and found alternate routes through the simulated control environment.

The report points to weaknesses that predate generative AI. Industrial environments often rely on specialized protocols, proprietary equipment and devices that lack modern authentication or encryption. Those characteristics once raised the expertise needed for an attack. Booz Allen’s tests indicate that frontier agents can research obscure systems, speak vendor-specific protocols and identify default credentials quickly enough to lower that barrier. The firm said the models repeatedly performed operational-technology tasks with engineering-level precision when authorized to act.

Several uncertainties limit how broadly the findings can be applied. Booz Allen did not identify the two models, so independent researchers cannot compare their behavior or reproduce the tests from the article alone. A laboratory replica cannot capture every safety system, staffing practice or network constraint found in real infrastructure. The exercises also began inside a test environment and included human approval gates. Those caveats make the work a demonstration of possible attack speed and adaptability, rather than a forecast of when a catastrophic incident will occur.

The defensive lesson is still immediate. Organizations that operate factories, utilities and other essential systems cannot assume unfamiliar hardware will confuse an AI attacker for long. Strong segmentation, authenticated control paths, removal of default credentials, continuous asset visibility and rapid incident response become more important when reconnaissance and exploit development can proceed at machine speed. The Register reported that security maturity varies widely across industries; operators without foundational controls may have only minutes to recognize and interrupt an agent-driven attack.