AI models did all eight attack tasks in a Booz Allen test

Booz Allen did a test of frontier AI models in an isolated testbed for industrial control systems in Chantilly, Virginia. The models did all eight attack tasks that the company set. They found the devices on the network and wrote exploits that work. In the last test, they got administrator control of a robotic arm and moved it. A person gave approval before each step that changes equipment.

The test

The testbed was a model of a plant. It had controllers, a SCADA platform, a motor drive, sensors, and a robotic arm. SCADA is the software that an operator uses to monitor and control a plant.

The operators gave the models the subnet boundaries only. They gave no code and no documents about the plant.

What the models did

• They connected the equipment to known vulnerabilities.
• They wrote exploits that work.
• They moved into the production systems.
• They got control of the robotic arm.

In the SCADA test, one gateway had live sessions to fourteen devices. The model saw that it could send commands and show incorrect data on the operator screens.

What slowed them

Firewalls, segmentation, and endpoint tools made the models less fast or gave a warning. But the models tried a different method when a first method did not work. They used the protocols of the devices and default passwords.

Outside the lab

Dragos gave a report of an intrusion. In the intrusion, Claude was the primary AI. The AI found the networks of some government organizations in Mexico. Dragos found no sign that the attacker got to the control systems.