Two frontier models complete all eight attack scenarios against an industrial control network, reaching physical equipment in about 16 minutes
Partly confirmed
The takeaway
The Register reported on Oct 11, 2026 that Booz Allen Hamilton ran two unnamed “latest frontier models” as attackers in its operational technology (OT) lab, a network modeled on a manufacturing plant.
Status
- Claim
Partly confirmed
- Our reporting
- Medium confidence
- Importance
- 3 of 5
- Last verified
- 12 October 2026
Your AI and this story
- GPT-6 Astra164 days after its cutoff
- Claude Opus 5.5103 days after its cutoff
- Gemini 3.8 Flash194 days after its cutoff
- Grok 4.7133 days after its cutoff
None of these four assistants can know about it. The closest, Claude Opus 5.5, stops 103 days before it.
Key facts
- Source: The Register (Jessica Lyons, Oct 11, 2026) on a Booz Allen report about its OT lab tests; the models are described only as ‘the latest frontier models from the leading AI providers’
- Environment: multi-vendor network modeled on a general manufacturing facility with enterprise, industrial DMZ, plant operations and production zones; PLCs, HMIs, engineering and operator workstations, a SCADA platform, a variable-frequency drive, sensors and a collaborative robot arm
- Conditions: no source code, engineering documents or advanced OT/IT guidance; human approval was required before any exploit or action with physical effect, and agents were told to use extra caution around safety-critical devices
- Eight scenarios, all achieved: environment mapping, vulnerability discovery, turning vulnerabilities into access, moving into production systems, manipulating controllers, changing AC motor speed, compromising SCADA, moving a robotic arm
- Speed: perimeter compromise to actions inside the industrial control network in just over 16 minutes; in one case an agent found and moved the robot arm within minutes (it learned the arm’s protocols and vendor default credentials)
- SCADA: after a first attack path failed (wrong HMI version) the agents adapted, found editable code in the exported SCADA project and pushed a full-screen takeover of the operator display; the SCADA gateway held live, pre-authenticated sessions to 14 OT devices
- Unprompted finding: an agent noticed a safety-critical protective relay sending unanswered network requests for a missing peer and proposed impersonating that peer in a listen-only posture
- Report: ‘Specialized OT knowledge, unfamiliar equipment, and complex control environments are no longer meaningful barriers to attack’
Show 2 more
- Kyle Miller, Booz Allen VP of infrastructure cybersecurity: ‘Some OT organizations are prepared, but many are not’; consequences ‘could range from mechanical damage and downtime, to life safety’
- Caveats: a consulting firm’s lab test, not production systems; models unnamed; not independently verified
What happened
Booz Allen Hamilton, which published a Cyber Weapon Index of models as attackers on enterprise IT networks in September, repeated the exercise on industrial equipment. Its OT lab has the layers of a real plant, from office network down to controllers, drives and a robot. Two frontier models, driven as agents and gated by human approval for anything risky, completed every one of the eight tasks.
The Register highlights two details. The agents recovered from a failed first attempt on the SCADA system and made the operator’s screen show what they chose. And one agent, without being asked, spotted a misconfigured safety relay and proposed a way to exploit it.
Why it matters
Attacks on industrial control systems used to need rare, vendor-specific expertise. This test suggests general frontier models now supply it. The context is a run of real incidents in 2026: lab agents breaking into Hugging Face, AI-assisted attacks on South Korean banks and Taiwanese government sites, and AI-written scripts used against internet-exposed PLCs at US facilities (all cited by The Register). OpenAI, Anthropic and Google have each started programmes that give infrastructure operators defensive access to their models.
Note: written from The Register’s account. We did not find Booz Allen’s report page, so its title and publication date are not confirmed.
Sources
2 sources from 2 sites. Numbers match the chips in the text.
2 sources: 2 press
Press
Changes
- Filed (The Register read directly)