AI Can Already Attack Industrial Infrastructure. Most Defenders Aren't Ready.
A new report from Booz Allen Hamilton has delivered findings that should make anyone responsible for critical infrastructure security deeply uncomfortable. Autonomous AI agents, running on frontier models, successfully completed every single one of eight attack scenarios against a realistic operational technology (OT) environment. We're talking water, power, manufacturing controls — the stuff that keeps civilisation ticking.
The consulting firm built a test lab modelled on a real-world manufacturing facility, complete with programmable logic controllers, SCADA platforms, human-machine interfaces, industrial networking gear, a variable-frequency drive, and a robotic arm. Multi-vendor, imperfect segmentation, legacy firmware — deliberately messy, because that's what actual OT environments look like after a decade or two of organic growth and minimal security investment.
The AI agents weren't given source code, engineering documents, or any specialised OT guidance. They had to figure things out themselves. They did. Quickly.
One test saw an agent move from initial network access to operating inside an industrial control network in just over 16 minutes. In another, the model found a robotic arm, identified its protocols and default credentials, gained administrative access, mapped its physical limits and safety zones, and actually moved the arm — all within minutes. Nobody prompted it to do any of that.
Booz Allen declined to name the specific models used, referring to them only as two 'frontier models from leading AI providers.' Which is vague enough to be mildly annoying, but the point stands regardless of which names are behind the curtain.
The SCADA test is particularly instructive. The agent's first exploitation attempt failed because it targeted the wrong version of the operator interface. So it adapted. It checked active sessions, identified which HMI clients were actually in use, found editable Jython code in an exported SCADA project, rebuilt its payload, and executed a full-screen takeover of the control room display. It also discovered that the SCADA gateway was holding live, pre-authenticated sessions to 14 separate OT devices. One compromise, 14 doors open.
In a separate test, without any human prompting, an agent noticed that a safety-critical device had been broadcasting ARP requests for over 45 minutes, calling out for a communications peer that no longer existed on the network. The agent worked out that by claiming the dead IP address, it could impersonate the missing peer and have the relay device hand over a control-channel session. That's not brute force. That's operational reasoning.
Kyle Miller, VP of infrastructure cybersecurity at Booz Allen, put it plainly: specialised OT knowledge and obscure proprietary protocols are no longer meaningful barriers. Attackers used to need genuine expertise to exploit industrial systems. Now they need an agent and a network foothold.
This matters because OT protocols were designed for reliability, not security. Authentication and encryption are frequently absent. Once you're on the network, many devices will simply do what they're told. Historically, obscurity and air gaps provided a degree of protection. Both of those assumptions are eroding fast.
This isn't purely theoretical. Suspected Chinese operators reportedly used AI agents in attacks on South Korean financial institutions and Taiwanese government sites. Suspected Iranian actors used AI-generated exploitation scripts against internet-exposed PLCs at water and energy facilities in the US. Hugging Face saw frontier models gain unauthorised access to external systems in real-world incidents. The research is catching up with operational reality.
OpenAI, Anthropic, and Google have all announced programmes to provide critical infrastructure operators with access to their models for defensive purposes, which is either reassuring or a bit rich depending on your level of cynicism.
Miller's assessment of where the sector stands is blunt: some OT organisations are prepared, many aren't. Security maturity varies wildly, environments are siloed and globally distributed, and foundational controls are frequently missing. The organisations without those basics in place may find that AI-enabled attackers can move faster than their defenders can even detect what's happening.