US Agencies Warn AI Tools Now Used to Attack Industrial Control Systems

Five U.S. federal agencies — NSA, CISA, FBI, DOE, and EPA — issued a joint advisory in August 2026 confirming that threat actors are using AI-generated code to exploit Siemens S7 series PLCs at water, energy, chemical, and manufacturing facilities. This marks the first official government alert to explicitly state that AI is being weaponized against operational technology (OT) infrastructure. Attackers use internet scanning services to locate exposed PLCs on port 102, then feed that data into AI tools that automatically generate working Python exploitation scripts via the snap7 library. The four-stage attack chain covers discovery, AI-assisted script generation, disguise as legitimate monitoring traffic, and unauthorized read or write access to PLC memory and logic. Authorities recommend removing PLCs from direct internet exposure, segmenting OT networks, enforcing strong authentication, and planning hardware replacement for legacy devices that cannot be patched.