Booz Allen put 18 frontier AI models in front of a real network, let each one drive an attacker machine on its own, and scored them on what the network's logs proved they did rather than on what they claimed. One model completed the entire intrusion without help. Then the firm re-ran the test, and in under a week there were two.
That is the useful part of this autumn's AI-and-OT conversation: it is measured, not asserted. The figures come from The Offensive Frontier: AI as the Attacker, the report behind Booz Allen's Cyber Weapon Index, whose release Defence Industry Europe covered on 2 September 2026 (Defence Industry Europe).
What was actually measured
The index combines two scores. The Vulnerability Research Score measures whether a model can find planted and novel vulnerabilities in real-world binary code with no source available. The Kill Chain Attainment Score measures how far it progresses through a seven-stage intrusion in a live Active Directory environment, tested both with and without starting credentials. The index is the average of the two.
Each model drove a real attacker machine, issuing commands one at a time with no tool menu and no scaffolding, which isolates the model from its framework. Scoring came from network traffic, host logs, domain controller logs and IDS output.
In the first ranking, one model, Anthropic's Claude Mythos, executed the full kill chain reliably. Given a foothold such as a stolen employee credential, it gained administrator-level control in every attempt, working out how to escalate from what it found rather than following a fixed plan. On the harder run with no credentials at all, it got in from the outside where every other model failed.
The spread underneath that result matters more. Four models reached full domain access and control, another four achieved lateral movement, two progressed through credential access, and all but one autonomously penetrated the network. Booz Allen assesses that most models tested will reach full kill chain capability within six months.
The leaderboard moved in a week
The report now carries an addendum subtitled "One Week Later". In that time five new models entered the top 18, two of them in the top three, and OpenAI's GPT-6 Astra narrowly took the lead. Astra scored lower on kill chain execution but set a new high mark on vulnerability research, finding a subtle flaw in a large production library without cyber-specific tuning.
Five of 18 positions, 28 percent of the leaderboard, changed inside a week. Booz Allen's conclusion is that point-in-time assessment of offensive AI capability is no longer sufficient. For a plant security team the reading is narrower: any risk assessment naming a model, a capability level or a published benchmark has a shelf life measured in weeks.
This was not an OT test, and that cuts both ways
The index ran against a production-grade enterprise network and a live Active Directory domain. There are no PLCs in it, no S7comm, no safety instrumented systems and no consequence model for a process going out of control. Nobody should present these numbers as a measurement of autonomous attacks on OT.
What they do measure is the path that reaches OT. Recon, initial access, foothold, credential access, privilege escalation, lateral movement, domain control: that is the IT-side sequence preceding almost every industrial incident that did not start with an internet-exposed controller. Compress it and you compress the time before somebody is standing at the IT and OT boundary holding legitimate credentials. We covered the other end in August, when five US agencies warned of AI-generated scripts against internet-exposed Siemens S7 PLCs.
The OT-specific argument is being made elsewhere, and more thinly. Industrial Cyber reported on 5 October that Frank Cilluffo and Brad Medairy published a piece on 28 September for Auburn University's McCrary Institute for Cyber and Critical Infrastructure Security, arguing that AI is accelerating threats to the OT behind power, water and manufacturing and helps attackers find disruption paths faster and with less specialised expertise. Per that write-up they draw on controlled testing of frontier models in OT environments and a September tabletop convened by Booz Allen and the Institute, and set three priorities: assess readiness and resilience, accelerate remediation and response at machine speed, and prepare to operate under compromise (Industrial Cyber). The Institute's own site was not reachable for this post, so that is secondary coverage rather than the source document, and the OT testing is not described in detail.
Your binding constraint is detection latency
The second of those priorities, as Industrial Cyber reports it, is that many security processes still rely on a person to investigate, decide and act, and that this is no longer adequate. Set that against what industrial organisations say about themselves.
In Honeywell Technologies' 2026 OT Cybersecurity Benchmark, 88 percent of 603 OT security leaders described their programmes as planned or design-led, while only 33 percent said OT was fully integrated into an enterprise SOC with centralised visibility and only 21 percent reported a complete asset inventory (Honeywell report). We covered that gap here.
The same report ties detection to outcome. Among respondents whose organisations had suffered an incident, 41 percent credited early threat detection with restoring operations quickly, the most cited factor of any. The share reporting downtime of six hours or less was 17 percentage points higher among respondents with stronger asset visibility than among those with weaker visibility.
So two thirds of industrial programmes have no centralised view of their OT, and the thing that most often shortens an outage is seeing the intrusion early. Model capability is not the variable you control. Detection latency is. Movement that never crosses a firewall is harder still, which is why it matters that Forescout found only 13 percent of segments holding OT devices held nothing else.
The counter-AI number has a product attached
One figure is circulating without its context. Booz Allen states that in its testing, coordinated counter-AI playbooks reduced attacker success by more than 95 percent. That is a vendor's self-reported result from the vendor's own test environment, announced in the same release as Vellox Labs Guile, Booz Allen's commercial counter-AI product (Defence Industry Europe).
Deception has a track record, but 95 percent is not a number to plan against until somebody independent reproduces it. Booz Allen's own 2026 Velocity Survey of federal cyber and IT leaders found only 28 percent confident that AI agents could be deployed securely, the same adoption-and-assurance gap behind the coding-agent flaws that ran code nobody approved.
What to do this quarter
- Stop treating model capability as the planning variable, and give the threat a review date. It changed by 28 percent of a leaderboard in a week. Plan against your own detection and containment times, and re-read the baseline quarterly rather than assessing it once.
- Measure time to notice. Take your last three OT-relevant alerts and record the gap between first telemetry and a human looking at it. That number, not a maturity tier, is what an AI-paced intrusion races.
- Close the centralised visibility gap before buying anything AI-labelled. If OT is not in a SOC with one view, a faster attacker simply arrives unobserved.
- Rehearse operating under compromise. Manual or alternate operating paths, degraded-mode response, clear decision rights across the IT and OT boundary. Most programmes have tested none of it.
- Assume credentialed lateral movement. Every model that got anywhere used legitimate access. Privileged access management, per-session authorisation for vendors and east-west monitoring are the controls that bite, and the SP 800-82r4 draft now emphasises them.
Where MBCTG fits
None of this changes what an industrial security programme has to be good at. It changes how much time it has to be good at it.
Knowing what is on the network and seeing the traffic between zones comes first, and passive asset visibility produces both without touching a controller. That is the foundation of our OT security services. Cutting the gap between telemetry and a decision is harder and not a tooling purchase, which is what our 24/7 SOC exists to carry. Testing whether you can keep running during a compromise, and evidencing it against IEC 62443 or NIST CSF 2.0, is compliance and GRC work.
If you cannot say how long an anomaly on a control network takes to reach a human, talk to an MBCTG expert. That interval is the one number in this story you own.
