AI agents breached simulated factory in 16 minutes, lab finds

Autonomous AI systems can find and attack industrial control equipment without expert help, according to a Booz Allen Hamilton report covered by The Register on 11 October 2026. The consulting firm's operational technology (OT) lab ran two frontier AI models through eight attack scenarios in a mock manufacturing plant. The models met the objective in all eight. In one test they located a robotic arm and made it move within minutes. In another, they went from compromising the network perimeter to taking actions inside the industrial control network in just over 16 minutes.

Operational technology means the computers and controllers that run physical processes, such as pumps, motors and production lines. Booz Allen said the test environment was built to mirror real plants: a layered network split into enterprise, industrial DMZ, plant operations and production zones, with firewalls and switches between them. The lab contained programmable logic controllers, human-machine interfaces, engineering and operator workstations, a SCADA supervisory control platform, network gear, a variable-frequency drive, a robotic arm and sensors from a mix of vendors. The report said mixed firmware, control logic and imperfect segmentation reproduced the technical debt common in long-lived OT sites.

The models were given no source code, engineering documents or OT guidance, so the testers could see how much research, planning and execution the systems could manage alone. Guardrails were applied: agents had to wait for human approval before exploiting a flaw or taking any action that could have a physical effect, and were told to use extra caution near equipment they judged safety-critical.

The tests asked whether the models could map the environment, find vulnerabilities, turn them into working access, chain weaknesses to reach production systems, manipulate controllers from several brands, change the speed and start/stop state of a connected AC motor, compromise SCADA and alter operator screens, and locate and move the robotic arm. According to the report, the answer in each case was yes, and at machine speed.

The SCADA test showed the models adapting. The first attempt failed because the agents targeted the wrong version of the operator interface. They then checked active sessions, worked out that the control room used a different version of the HMI client, found editable Jython code in the exported SCADA project, rebuilt the payload and used the administrative interface to push a full-screen takeover visible in the control room. The report said the model also found that the SCADA gateway exposed live, pre-authentication connections to 14 OT devices, so compromising that one device gave access to the others, including PLCs.

Booz Allen's conclusion is that specialised OT knowledge, unfamiliar equipment and complex control environments are no longer meaningful barriers to attack. The report noted that many OT devices use no authentication or encryption once an attacker is inside, making malicious commands easy to issue. That lowers the skill level needed to cause physical disruption.

"Our testing showed that AI agents can operate with a speed, persistence, and engineering-level precision that may outpace organizations that have not implemented foundational OT cybersecurity practices," Kyle Miller, vice president of infrastructure cybersecurity at Booz Allen, told The Register. He added that while there is no defined timeline for a worst-case scenario, the firm continues to see growing use of AI in real-world attacks, and that risk grows as model capabilities grow.

The company declined to name the two models, describing them only as recent frontier models from leading AI providers. It is calling for more industry testing and wider deployment of defences across OT and other critical infrastructure networks. If such an attack happens, the report said, defenders may have only minutes to detect and block it.