Booz Allen: AI agents moved OT equipment within minutes

AI agents with no prior knowledge of an industrial environment were able to find their way around it, work past obstacles, and physically move equipment within minutes, according to a new report from Booz Allen.

The firm presented the findings last week at SecurityWeek's Industrial Control Systems (ICS) Cybersecurity Conference in Nashville, before the report's public release. Booz Allen describes the result as "frontier super intelligence" that "navigated unfamiliar industrial systems, adapted when blocked, and moved physical equipment within minutes."

A confusing choice of words

The phrase "super intelligence" has drawn questions. Booz Allen has used it before, and it appears to mean much the same as artificial intelligence (AI). It also comes shortly after Donald Trump's September 29, 2026 Executive Order, which directs the executive branch to replace the term "Artificial Intelligence" with "Super Intelligence".

The difficulty is that "superintelligence", written as one word, already has a specific meaning. Oxford philosopher Nick Bostrom defined it in 2014 as "any intellect that greatly exceeds the cognitive performance of humans in virtually all domains of interest." That places it at or above artificial general intelligence (AGI), well beyond everyday AI.

SecurityWeek asked Booz Allen to clarify its terminology but had not received a reply at the time of reporting. The most reasonable reading is that the firm is referring to the growing capabilities of current frontier AI models, not a new class of AI.

Eight scenarios, every objective met

Booz Allen ran frontier AI models as agents inside its own isolated operational technology (OT) lab. OT covers the hardware and software that monitor and control physical processes, such as industrial machinery. The agents were given no source code, no engineering documents and no advanced OT guidance. The lab is not necessarily identical to a real enterprise OT setup, but it is a reasonable stand-in.

"Across eight scenarios, every defined test objective was achieved. More important, the models connected work that usually spans multiple people and stages, including asset discovery, device research, attack planning," the researchers said.

In one test, the models went from compromising the perimeter to taking actions inside an industrial control network in just over 16 minutes. In another, a model located a robotic arm, mapped its protection zones and motion limits, and then moved it, all within minutes.

Existing defenses did block or slow down some actions. However, no single safeguard reliably stopped the autonomous models from reaching their goals.

Obscurity no longer protects

The whitepaper notes that the idea of cyber actions causing physical effects is not new. "What has changed is the speed and precision with which these models can help produce those kinetic effects. They also undermine the 'security through obscurity' approach on which many operational technology (OT) environments have long relied," it explains.

The researchers warn that the window to prepare is closing. Their advice is for owners and operators to "focus less on predicting every form of frontier AI use in an attack and more on making their environments difficult to traverse, removing implicit trust, detecting consequential industrial changes quickly, and limiting what an attacker can affect after gaining access, whether through cyber or physical means."

Our Take

The study supports a view many security experts already hold: autonomous AI is pulling cyber security and physical security together. Agents that act faster than a human can step in mean that a single control is unlikely to be enough, and the results here, where no one safeguard held consistently, point the same way.

For OT operators, the most uncomfortable finding may be the loss of obscurity as a defense. Much industrial gear relies on being obscure and poorly documented, and legacy equipment still limits network visibility in many plants. If AI agents can work out unfamiliar systems on their own, that cushion shrinks.

It is worth watching whether the full report's release adds pressure to calls for a binding OT security directive, and whether vendors and regulators settle on clearer definitions of what kind of AI they are actually talking about.