AI Agents Demonstrate Growing Capability in Hacking Operational Technology
Advanced AI models, with human guidance, can now autonomously execute individual stages of multi-stage attacks against unfamiliar OT networks, lowering the barrier to entry for attackers.
While fully autonomous AI-powered cyberattacks against Operational Technology (OT) remain in the realm of theoretical future threats, recent research indicates a significant leap in AI capabilities. Two independent studies have demonstrated that advanced AI models, including large language models (LLMs) and their agents, can reliably execute individual steps within a multi-stage attack chain against unfamiliar OT environments, albeit with some human guidance. This development effectively lowers the barrier to entry for exploiting industrial control systems, a domain previously requiring specialized knowledge and training.
Researchers from Booz Allen Hamilton and Frenos have independently validated these findings. Booz Allen Hamilton's team utilized AI agents built around LLMs from leading providers like Anthropic and OpenAI within a dedicated OT lab. Their findings suggest that specialized OT knowledge, unfamiliar equipment, and complex control systems are no longer insurmountable obstacles for AI-assisted attackers. Similarly, Frenos tested various frontier and open-weight models, observing their ability to outline and execute attack steps against OT systems.
Crucially, human intervention remains a requirement for the "near future," according to experts like Harry Thomas, co-founder and CTO of Frenos. He noted that while AI models can perform individual attack stages, a capable "agentic harness" is still needed for unattended execution. Furthermore, AI-driven attacks can be "noisy," potentially alerting security systems like SOAR and incident response platforms if mistakes are made within an OT environment. The level of human expertise needed varies; frontier models require less input than open-weight models, which demand more knowledgeable operators.
The implications for critical infrastructure are substantial. Rob Bair, principal industry advisor for cybersecurity at Anthropic, stated that AI-enabled attacks will likely increase the risk to these sectors due to the reduced entry barrier. Even an unsophisticated attacker could leverage online information about specific facilities, like water plants, to guide an LLM effectively. While complex systems like nuclear power plants may present unique challenges due to their intricate safety and control mechanisms, the general trend points towards increased vulnerability.
Experts emphasize that the knowledge barrier to hacking OT was never entirely insurmountable, especially for nation-state actors or financially motivated groups targeting easier opportunities. Marcus Sachs, senior vice president and chief engineer at the Center for Internet Security, noted that AI "democratizes" the process, allowing individuals with creativity and imagination to leverage new tools without deep expertise in OT-specific protocols. He cautioned against alarmism, framing AI as the latest in a series of technological shifts that will necessitate evolving defense strategies.
Sachs also pointed out that information on OT protocols and systems has long been available online through public resources and textbooks, meaning dedicated individuals could already acquire the necessary knowledge pre-AI. The advent of AI simply accelerates and simplifies this process. While AI is not an apocalyptic threat, it represents a significant evolution in attack capabilities that defenders must acknowledge and prepare for.
Both research teams conducted their experiments in controlled, air-gapped lab environments designed to mimic real-world OT networks. This controlled setting allowed for detailed observation of the AI agents' performance without risking actual infrastructure. The studies highlight the ongoing arms race in cybersecurity, where advancements in AI are rapidly being weaponized, demanding continuous innovation in defensive measures.