Dragos industrial AI research uncovered relay flaws and disrupted two lab devices

Dragos tested frontier cyber assistants in industrial-control environments during late summer 2026 and published its whitepaper in September. The actual study names GPT-5.5 Cyber and GPT-5.6 Sol. Although OpenAI linked the research from its November 5 GPT-6 Cyber announcement, the earlier findings cannot be retroactively attributed to that model.

Seven exploratory assessments included remote industrial discovery, protective-relay engineering software review, firmware investigation and reconstructed malware studies. In an electric-utility test environment, the agent found two previously unknown vulnerabilities in relay engineering software. One exposed protective relay event archives without authentication, and another revealed a hardcoded bearer token via served JavaScript. Researchers used the combination to examine event history and protection configurations. In a water-system test, interactions with an Allen-Bradley MicroLogix 1100 caused the PLC to stop responding. A separate live HMI test involving a firmware-derived heap-overflow path rendered its FTP service unavailable. Both outages occurred in a test setting, not an operational grid.

The study reports human intervention to recover credentials, validate hypotheses and stop incorrect paths. Device-identifying details and exploit artifacts remain withheld. Seven cases form a scoped exploratory series, not a statistically controlled field population or a demonstration of autonomous infrastructure sabotage. The GPT-6 Cyber release is a related later milestone, with different evaluated weights and access restrictions.

The two discovered relay-software flaws are also different from the two accidental device outages. An unauthenticated archive read and a token exposed in delivered JavaScript concern access to protection configuration and telemetry. A MicroLogix 1100 becoming unavailable and an HMI FTP service stopping after a malformed firmware-derived interaction concern the effect of a test procedure on physical-control equipment. The former need patch and information-access review; the latter need pre-action device safety constraints, isolation and recovery plans. Neither proves a live attack on a power plant or wastewater service.

For provenance, the September whitepaper describes seven exploratory assessments with GPT-5.5 Cyber and GPT-5.6 Sol and records human validation. The November GPT-6 Cyber announcement linked the report as related work, but did not change the previously tested weights. A cross-study comparison must hold model version, industrial target, tester authority and permitted effects distinct.