Tech and AI

Five United States agencies warn that attackers are using AI-generated scripts to find and exploit internet-exposed plant controllers

By Staff Writer  |  20 August 2026

A joint advisory issued on 19 August tells owners and operators of Siemens S7 Series programmable logic controllers that reconnaissance against United States installations is under way, carried out with exploitation scripts generated by artificial intelligence and disguised as legitimate monitoring tools. Water and wastewater, energy, chemical, food and agriculture, critical manufacturing and commercial facilities are named as the sectors most targeted.

The advisory is numbered AA26-231A and it is signed by five bodies: the National Security Agency, the Cybersecurity and Infrastructure Security Agency, the Federal Bureau of Investigation, the Department of Energy and the Environmental Protection Agency. Its subject is the programmable logic controller, the small industrial computer that opens a valve, starts a pump, holds a set point and trips a machine on an interlock. It is the piece of plant a designer specifies, an integrator commissions and an operator then lives with for twenty years.

What the agencies say is happening

The described activity is reconnaissance and capability development rather than a reported outage. Attackers are said to be using internet scanning services to find controllers that are reachable from the internet and are either running outdated software or are otherwise poorly protected. The exploitation scripts are generated with artificial intelligence assistance from information about these controllers that is already published, and they are dressed up to look like monitoring tools. The stated objectives are initial access, credential access, denial of service and others.

The advisory explains why the use of a language model matters here: it represents, in its own words, an evolution in threat actor capabilities, dramatically reducing the technical expertise and time required to develop working exploitation scripts and malicious tools for industrial control systems.

Five families of controller are listed by name. The S7-200, S7-300 and S7-400 series are covered across all central processing unit variants, with the 314, 315 and 317 models called out within the S7-300 range. The S7-1200 series is listed at CPU 1211C, 1212C, 1214C, 1215C and 1217C. The S7-1500 series is covered across all variants, and the advisory makes a point of including the F-series safety controllers within it. That last inclusion is the one to sit with, because a safety controller is what an operator relies on when everything else has gone wrong.

The detection guidance is concrete enough to hand to a maintenance contractor without translation. Watch for connections to controllers from workstations that are not engineering workstations, for unusual patterns of data block access, and for write operations outside a change window. Watch for sequential scanning of addresses on port 102, which is the port the S7 communication protocol answers on, and for repeated connection attempts with varying parameters. Watch for configuration changes with no matching work order or change ticket, and for connections from countries or address ranges that have nothing to do with any vendor or integrator on the project.

The recommended actions run to seven headings: inventory every controller, apply the critical patches, make sure nothing is reachable from the internet, tighten access control, monitor for unauthorised activity, harden the controller's services, protocols and ladder logic integrity, and hunt for anomalies.

It is not a single manufacturer's problem

A note at the top of the advisory says the targeting of controllers is broader than one manufacturer and that all owners and operators should apply the relevant mitigations, with the Siemens-specific material read as one subset of a wider picture. That reading was echoed by the operational technology security company Frenos.

Siemens S7 is the subject here, but the exposure pattern is not brand specific.

Brian Proctor, founder and chief executive, Frenos

Proctor put the practical consequence in terms an engineer will recognise: "An adversary who has mapped your data blocks understands your process. They know what normal looks like, which means they know what an operator would fail to notice."

Where this lands on a project

One line ought to be read twice by anyone running an estate or handing one over. Organisations that rely on third-party service providers or systems integrators are told to share the advisory with those parties and ask for the mitigations to be implemented, because remote access held by an integrator can leave an asset owner exposed without the owner realising it. On a building services package, a water treatment contract or a process plant, that connection is usually a maintenance convenience agreed at commissioning and rarely revisited.

The consequences the agencies list are the ones that turn into claims: disruption of industrial processes, safety incidents, downtime or damaged equipment, compromised data, compliance breaches and knock-on effects across connected systems. None of that is new as a category of loss. What has changed is the cost of producing a working attack script, and the advisory says plainly that it has fallen.