Booz Allen Tests Show AI Models Can Move Industrial Equipment

Frontier artificial intelligence models have demonstrated the ability to navigate unfamiliar industrial control systems and move physical equipment during controlled laboratory tests conducted by Booz Allen. The findings highlight how AI-assisted cyber operations could progress from digital network access to actions affecting industrial machinery.

Across eight test scenarios, the models achieved every objective set by the researchers. In one scenario, a model identified an industrial robotic arm, mapped its movement limits and safety zones, and moved it within minutes. In another, a model progressed from a perimeter compromise to activity inside an industrial control network in just over 16 minutes.

The tests took place in Booz Allen’s isolated Operational Technology (OT) Cybersecurity Lab. The company said the results demonstrate how rapidly AI systems can combine network discovery, vulnerability research, attack planning and troubleshooting in environments that control physical processes.

AI Models Navigate Unfamiliar Industrial Networks

The test environment replicated a manufacturing facility, bringing together enterprise networks, industrial control systems, programmable logic controllers, supervisory control and data acquisition (SCADA) software, sensors, motor drives and robotic equipment.

Researchers gave the models limited initial information rather than providing source code, engineering documents or specialised operational technology guidance. The models then mapped network assets, identified potential weaknesses and developed paths towards the test objectives.

Their performance extended beyond identifying vulnerabilities. The models adapted when initial approaches failed and explored alternative routes through the environment. In one scenario, a model identified a gateway with existing authenticated connections to 14 operational technology devices, exposing a route to multiple industrial controllers.

The results suggest that AI systems can connect several stages of a cyber operation faster than traditional workflows that require multiple specialists. However, the tests were conducted in a controlled laboratory and do not establish that the same outcomes would occur in every operating factory.

Robotic Arm Test Demonstrates Physical Risks

The robotic arm scenario illustrated the potential consequences when access to digital systems leads to physical action. After identifying the equipment and assessing its movement constraints, a model successfully moved the arm during the experiment.

Such capabilities matter because operational technology directly monitors or controls machinery, production processes and other physical infrastructure. An intrusion into these environments could affect equipment operation, production availability and worker safety.

Booz Allen also found that existing protections sometimes blocked or delayed actions. Firewalls, network segmentation and endpoint security tools created obstacles, while a controller rejected a stop command and a local setting prevented a remote motor start in specific tests.

However, no single safeguard consistently stopped the models from reaching their objectives across all eight scenarios. The findings therefore point to the need for multiple layers of protection rather than reliance on a single security control.

Industrial Operators Face New AI Security Challenges

The research highlights the importance of securing connections between enterprise IT networks and operational technology environments. Organisations can reduce exposure by limiting unnecessary network access, reviewing authenticated sessions, strengthening administrative interfaces and monitoring unexpected changes to controllers and supervisory systems.

Physical safety controls also remain important. Device-level protections, local operating modes and tested recovery procedures can help limit the consequences of a compromised digital system.

Booz Allen’s results do not mean that AI models can automatically take control of every industrial facility. The tests depended on a particular laboratory configuration, and the consequences in a real facility would vary with its architecture, equipment and safeguards. Human operators also approved exploits and actions capable of producing physical effects during the experiments.

Conclusion

Booz Allen’s tests demonstrate that frontier AI models can combine cyber operations with physical equipment control under controlled conditions. As these systems become more capable, industrial operators will need to assess not only whether their networks can be breached, but also what an intruder could physically change after gaining access.