Much of the AI security conversation has been about data: leaked prompts, stolen credentials, models escaping a sandbox. A new report from Booz Allen moves it somewhere more physical.
The firm ran frontier AI models as agents inside its own isolated operational technology (OT) lab. The agents were given no prior knowledge of the environment: no source code, no engineering documents and no specialised OT guidance. The results were presented last week at SecurityWeek's ICS Cybersecurity Conference in Nashville, ahead of public release.
What the agents did
Across eight scenarios, every defined test objective was achieved. The researchers say the models connected work that usually takes several people and several stages, including asset discovery, device research and attack planning.
Two results stand out:
- In one test, the models went from a perimeter compromise to actions inside an industrial control network in a little over 16 minutes.
- In another, a model found a robotic arm, mapped its protection zones and motion limits, and moved it within minutes.
Existing defences did block or slow some actions. But no single safeguard consistently stopped the agents from reaching their objectives.
Why it matters for OT
Booz Allen's whitepaper makes the point that cyber actions causing physical effects is not new. What has changed is the speed and precision with which these models can help produce them. It also says they undermine the "security through obscurity" that many OT environments have relied on for years. An unfamiliar, poorly documented control system used to be a real barrier for an attacker. These tests suggest it is much less of one for an agent.
A caveat worth keeping in mind: the lab is a reasonable stand-in for enterprise OT, not a copy of any particular plant.
The terminology problem
SecurityWeek's Kevin Townsend raises a fair complaint. Booz Allen describes the models as "frontier super intelligence," a phrase that follows the US executive order of 29 September 2026 replacing "Artificial Intelligence" with "Super Intelligence" across the executive branch. It is easy to confuse with superintelligence in the long-established sense of a system that far exceeds humans. As SecurityWeek reads it, the report is describing today's frontier models, not a new class of AI. SecurityWeek asked Booz Allen to clarify and had no response at publication.
What operators should do
The researchers' advice is to stop trying to predict every way frontier AI might be used in an attack and focus instead on:
- making environments hard to move through,
- removing implicit trust,
- detecting consequential industrial changes quickly, and
- limiting what an attacker can affect once inside, by cyber or physical means.
My read
If you run plants, utilities or logistics, I'd put this report in front of the board. The usual OT comfort, that attackers need deep domain knowledge and time, is exactly what these tests weaken. That shifts the weight onto segmentation, change detection on physical processes, and hard limits on what a compromised system is allowed to command. Those controls hold up even when an attacker learns the environment faster than your team can respond.
