A study conducted by Booz Allen showed that AI agents can explore unfamiliar operational technology (OT) environments, adapt to obstacles, and make changes affecting physical equipment within minutes. The findings are significant because they indicate that the potential risk can extend from digital compromise to control of industrial systems and physical equipment.
The study’s findings were presented at SecurityWeek’s Industrial Control Systems (ICS) Security Conference in Nashville, before the report was made publicly available. The company conducted the tests inside an isolated OT laboratory, using advanced AI models that had no prior knowledge of the environment, including its source code, engineering documentation, or specialized OT guidance.
Test results
According to the researchers, the models achieved every defined objective across eight scenarios. The tasks were not limited to a single step; rather, they combined asset discovery, research into device characteristics, and attack planning—stages that are typically distributed among multiple people and teams.
In one test, the models moved from a perimeter breach to carrying out actions inside an industrial control network in just over 16 minutes. In another test, a model located a robotic arm, identified its protection zones and movement limits, and then moved it within minutes.
Some existing defenses were able to block or slow certain actions, but the study found that none of the controls, individually, consistently stopped the autonomous models from achieving their objectives within the tested scenarios.
What changes in practice?
The study shows that the difference lies not only in AI’s ability to carry out offensive steps, but also in the speed with which it connects stages that would normally require sequential human intervention. In OT environments, this acceleration could turn cyber activity into a physical impact before security teams can understand or interrupt the chain of actions.
Booz Allen believes that relying on the obscurity of an OT environment or on an attacker’s lack of knowledge about its details is no longer sufficient, particularly if models can infer device characteristics and interact with systems through direct exploration. However, the study itself acknowledges that the company’s laboratory does not necessarily match every enterprise OT environment, which is an important limitation when generalizing the findings.
What does the study recommend?
The researchers recommend that system owners and operators focus on making movement within the environment more difficult, eliminating implicit trust, rapidly detecting impactful industrial changes, and reducing the scope of what an attacker can affect after gaining access, regardless of whether access began through a cyber or physical means.
The meaning of the term “superintelligence” used by Booz Allen remains unclear, as the company had not explained, at the time this material was prepared, whether it meant advanced AI in the commonly understood sense or a more specific concept. The tests also do not prove that every industrial environment would experience the same results, but they provide a practical indication that individual defenses may not be sufficient against agents capable of operating quickly and autonomously.