AI agents hack a Booz Allen test factory and move a robotic arm

A little over sixteen minutes. That is how long it took an AI model, in a lab run by the US firm Booz Allen, to go from compromising the perimeter to taking actions in the network that runs a test factory.

That is just one of eight attack scenarios Booz Allen ran with so-called "frontier" AI models, used as autonomous agents. In all eight, the agents reached every objective they were given, without having received source code, technical documentation or specialized guides on the targeted systems. The work was presented at SecurityWeek's ICS Cybersecurity conference in Nashville, then reported by SecurityWeek on October 14.

A robotic arm moved in a few minutes

The lab replicates a factory, with equipment from several manufacturers. Booz Allen describes four of the eight scenarios. In one, a model identified a robotic arm, mapped its safety zones and movement limits, then moved it "within minutes."

In another, facing a safety relay, a model noticed that the relay kept looking for an absent communication partner, which opened a possible path to impersonating it. In a test on supervision (SCADA, the software that controls industrial installations), the models found already-authenticated connections to 14 industrial devices.

The old safeguards held, in part

Not everything gave way. According to Booz Allen, a controller (PLC) refused a shutdown command, and a motor in local control mode could not be started remotely. But no single protection consistently stopped the agents on its own.

What the study doesn't say

The conditions were controlled: human operators approved every exploit and every action with a physical effect. On its presentation page, Booz Allen does not name the models used and gives neither the number of trials nor success rates; the full report is available for download. The firm acknowledges that the consequences in a real factory would depend on its architecture and protections. SecurityWeek also notes that the report uses the term "super intelligence" without defining it.

Booz Allen's recommendations

Attacks on industrial facilities are not theoretical: in France, a cyberattack disrupted refrigeration in hundreds of supermarkets overnight on October 11-12, targeting Danfoss refrigeration control units.

• Segment the network around the most critical processes, and remove dual-homed machines (connected to two networks), shared services and already-open sessions that cross security boundaries.
• Harden crossover systems: firewalls, switches, jump servers, administration interfaces, SCADA platforms, engineering workstations.
• Rank vulnerabilities by their possible physical effects, not just by severity score.
• Monitor controller mode changes, program writes and SCADA project imports, and keep tested backups.
• Keep the local safeguards on equipment, which remain useful even when the attacker has reached the industrial network.

One question remains open: which models carried out these attacks, and with what success rate? Until Booz Allen says, there is no way to know how reproducible those sixteen minutes are.