Case · DiggingBeagle record

Approved offensive agents reached industrial controllers and moved a robotic arm in a lab

Booz Allen reports an AI-led manufacturing OT red-team chain reaching control devices and a robotic arm, but every exploit and physical-effect action required a human reviewer.

Scope

Booz Allen Hamilton Frontier SI controlled OT lab report, public by October 17 2026; test devices and human-controlled action approval.

Assessment profile

Assessment method
Setting
research demonstration
Exploitation
demonstrated
Evidence
Grade C
Remediation
not applicable
AI role
WITH AI
Basis and provenance

Booz Allen directly reports eight completed controlled laboratory objectives and clearly states human approval before exploits and physical effect. The inspected account includes negative controls such as failed local-mode actuation and lacks an independent full replay environment. No industrial incident, physical damage or unsupervised attack probability is established.

Assessed Oct 18, 2026 using diggingbeagle.assessment/1.

At a glance

Mechanism and trust boundary

  1. 01

    Step

  2. 02

    Step

  3. 03

    Step

  4. 04

    Step

Claims & evidence

CLM-CP13-OT-LABBooz Allen reports agents achieving eight defined lab objectives, including reaching industrial controllers and moving a robotic arm in separate runs.supported

Basis: reported finding

Link to claim
CLM-CP13-OT-HUMANEvery exploit and every action with potential physical effects in the reported experiment was approved by a human operator.supported

Basis: reported finding

Link to claim
CLM-CP13-OT-BARRIERSSafety relay, local operation mode and other physical or network constraints stopped particular attempts despite agent progress elsewhere.supported

Basis: reported finding

Link to claim
CLM-ENRICH-OT-NEGATIVE-CONTROLSBooz Allen reports that a controller rejected a stop command and a motor in local mode could not start remotely, even while other human-approved lab objectives succeeded.supported

Basis: reported finding

Link to claim

Implications

The speed of an agent reaching a controller is different from physical permission to actuate equipment. Preauthenticated SCADA sessions and crossing administrative bridges matter operationally, but machine-local modes and controller safety rules can still enforce last-mile barriers. The eight completed lab objectives are not a predictive success probability for arbitrary factories.

Controls and mitigations

  • Remove unnecessary preauthenticated sessions and administrative bridges between enterprise and OT control networks, preserving device-local safety authority.
  • Monitor changes to controllers, SCADA projects and actuator modes as independent physical-state evidence; keep human authorization for any test that could move equipment.

Unknowns and contradictions

  • No independent reproducible test environment or public target controller versions.
  • No production loss, real industrial damage or wholly unsupervised physical intrusion established.

Sources and citation

Material revision history

  1. Oct 18, 2026 · Canonical change recorded · new in release · revision 171