Frontier AI models can move from an enterprise network into operational technology (OT) systems and take physical control of industrial equipment in as little as 16 minutes, according to new lab testing by Booz Allen. In one demonstration, an AI model navigated through a firewall and IT network, entered the OT environment, compromised a SCADA system, and moved a robotic arm. The finding challenges the long-standing belief that industrial systems are protected largely because attackers need deep, specialized expertise to understand and manipulate them.
Booz Allen built a mock enterprise OT network to assess how commercial AI agents could operate against infrastructure similar to that used by factories and utilities. The models completed all eight test objectives, including mapping the environment, identifying vulnerabilities, and achieving a physical outcome through an industrial controller. Researchers said the 16-minute attack window covered the full path from the perimeter firewall to an energized output on an OT controller. The test environment included some unpatched vulnerabilities, so the result did not account for the additional time needed to develop zero-day exploits.
The speed of the attack was the most striking result. Kyle Miller, vice president of infrastructure cybersecurity at Booz Allen, said AI removes many barriers that previously made OT intrusions difficult. Without human approval steps, the model may have completed the attack in roughly half the time. The report also cited a separate Claroty experiment in which an AI coding agent analyzed Danfoss refrigeration controllers, chained two known vulnerabilities, and gained root access in 28 minutes at an estimated cost of about $6 in computing tokens.
The findings arrive as AI-assisted intrusions become more common, although attacks that reach OT control networks remain relatively rare. Dragos reported that a small hacking group used commercial AI models during an early-2026 intrusion affecting at least nine Mexican government agencies. The AI helped identify a local water and drainage utility as a high-value target and research a possible route into its OT environment, but there was no evidence the attackers crossed into the control network. The incident still showed how AI can reduce the expertise and time required for large-scale reconnaissance.
For critical-infrastructure operators, the message is that security through obscurity is no longer enough. Experts recommend stronger network segmentation or micro-segmentation, continuous monitoring for anomalous OT behavior, and rapid containment controls that can block suspicious traffic automatically. Deception technologies such as honeypots and canaries can also slow attackers and reveal their activity. Organizations should additionally limit the permissions of AI agents used in operations, since a compromised agent with broad access could become another route into critical systems.
