NSA, FBI and CISA Warn of AI-Assisted Attacks on Siemens S7 PLCs: A Possible First for OT

Five US federal agencies have told the operators of industrial control systems that a hacking campaign built with “AI-assisted development” is actively targeting Siemens S7 Series programmable logic controllers (PLCs), the small ruggedized computers that run pumps, valves and other physical processes across the water, energy and manufacturing sectors.

The joint advisory, AA26-231A, was published on August 19, 2026 by the National Security Agency (NSA), the Cybersecurity and Infrastructure Security Agency (CISA), the FBI, the Department of Energy and the Environmental Protection Agency. It describes the activity as an “active threat,” not a theoretical one, and it may be the first time US agencies have attributed the use of AI-generated tooling to a campaign against operational technology (OT). That distinction, more than any single technical detail, is why this alert is worth your attention today.

If you run water, wastewater, energy, chemical, food, manufacturing or commercial-facility systems, the defender takeaway is narrow and old-fashioned. The agencies are not describing an exotic new exploit. They are describing exposed controllers, known weaknesses, and a faster path from a published vulnerability to a working tool because AI is now doing some of the writing.

What the Advisory Actually Says

Unidentified threat actors are conducting reconnaissance and capability development against US-based Siemens S7 installations, using AI-generated scripts disguised as legitimate monitoring tools, and using internet scanning platforms to find PLCs that are exposed and poorly protected. That is the core claim, stated up front in the alert.

The agencies frame the risk plainly. “Using AI to generate exploitation scripts represents an evolution in threat actor capabilities, dramatically reducing the technical expertise and time required to develop working ICS exploitation scripts and malicious tools,” the advisory states, as reported by CyberScoop. The agencies also describe the activity as “likely intended as persistent reconnaissance in targeted sectors and facilities to develop capabilities and prepare to cause operational effects against critical infrastructure.”

The Siemens S7 Series is the Simatic family that includes widely deployed controllers such as the S7-1200 and S7-1500, installed in thousands of utilities and plants. The affected sectors named in the alert are broad: water and wastewater, energy, chemical, critical manufacturing, food and agriculture, and commercial facilities. And the agencies are explicit that the brand is a starting point, not the whole map. “The Siemens-specific content in this advisory should be understood and applied as one subset of the wider threat landscape,” the advisory says.

The recommended response is deliberately unglamorous: isolate PLCs from the internet, install all available patches, and turn on security tooling to monitor for the activity. That instruction rhymes with a July warning in which CISA flagged Iran-linked actors targeting Siemens and Schneider Electric gear, and with a CyberSignal count of roughly 4,400 exposed Rockwell controllers, some in the exact cities hit during this summer’s water-sector intrusions. The exposure problem is not new. What is new is who is now able to act on it.

Why ‘AI-Assisted’ Is the Phrase That Matters

The specific wording is doing a lot of work, and it is worth preserving exactly. The Record reported the campaign is being fueled by “AI-assisted development” alongside exploitation of known vulnerabilities. That is a claim about how the tooling was built, not a claim that an autonomous system ran the attack on its own. The difference is not pedantic. It tells defenders that the change is in the attacker’s speed and reach, not in some new physics of how a PLC gets compromised.

So the framing changes the economics, not the mechanics. Michael Garcia, a former senior CISA official now at Monument Policy Advocacy, said it appeared to be a first. “It is the first alert I have seen where CISA is saying in a CSA that a malicious actor is using AI scripts to target OT systems,” he wrote on LinkedIn, per CyberScoop, which headlined the campaign as one that “could be a first.” Garcia also noted the advisory does not recommend using AI in response; it points back to well-known, traditional defensive measures.

Brian Proctor, chief executive of the OT penetration-testing firm Frenos, put the shift in blunt terms to The Record. “The barrier that used to be expertise is now time, and time is getting shorter,” he said. He described the reconnaissance as “the first half of an effects operation, and the second half is cheap once the first half is done,” and warned that the worst case is not a data breach but “loss of view, loss of control, and a physical process running in a state nobody in the control room can see.”

This is the throughline connecting today’s alert to the story CyberSignal has tracked all summer: the alleged Iranian intrusions at US water utilities and, separately, research into a near-autonomous AI attack in Taiwan. AI is lowering the skill floor for OT tradecraft. This advisory is the first time a US agency has said so about an active campaign, on the record.

How an exposed Siemens S7 PLC moves from discoverable to dangerous if left unmanaged, and the points the advisory says defenders control. Illustration: The CyberSignal.

What Is Not Confirmed

Read this section before you brief anyone upstream, because the gaps are as important as the claims. The advisory does not attribute the activity to a named threat actor or nation-state.

CyberScoop noted that the US government has blamed Iran for a recent campaign against water and wastewater systems, but this alert does not mention Iran. The advisory also does not name any victim utility, does not disclose the specific CVEs being exploited, and does not identify the specific AI models or tools used to generate the scripts. There is no confirmed Siemens ProductCERT advisory tied to this campaign, and Siemens did not respond to reporters’ requests for comment.

So the confirmed core is compact: an active, AI-assisted reconnaissance-and-capability campaign against exposed Siemens S7 PLCs, disclosed by five agencies, with defensive guidance attached. Everything past that, meaning attribution, exact flaws, and named targets, is not in the public record yet. Treat any claim that fills those blanks as speculation until an agency or Siemens says otherwise.

What Water and Critical-Infrastructure Operators Should Do Now

The advisory’s guidance maps onto steps most OT teams already know, which is precisely the point. In priority order:

• Confirm no S7 PLC is internet-facing. Check your own public IP ranges against internet scanning services such as Shodan and Censys, and ask your integrators to do the same. A controller should never answer a request from the open internet; if one does, that is your top fix today.
• Patch the known vulnerabilities. The campaign pairs AI-built tooling with exploitation of known flaws, so unpatched, outdated controller firmware is the fuel. Prioritize Siemens S7 patches and check the CISA Known Exploited Vulnerabilities catalog for anything already flagged in your inventory.
• Segment OT from IT. Enforce network segmentation so that reaching a PLC requires crossing controlled boundaries, not a flat corporate network. Reconnaissance depends on reachability; segmentation is what removes it.
• Hunt for the advisory’s indicators. Watch for tooling that masquerades as legitimate monitoring software and for anomalous reads against controllers. Enable and tune the monitoring the alert calls for, and pull the indicators from AA26-231A into your detections.
• Map third-party exposure. The advisory acknowledges that many operators do not know they are exposed because a vendor or integrator introduced the connectivity. Inventory every remote-access path a third party built into your OT, and close the ones you cannot justify.

None of this requires AI to defend against AI. As Garcia observed, the advisory itself points to traditional controls, not AI countermeasures. The controllers that get hurt here are the ones that were reachable and unpatched before any model wrote a line of script.

My Read

My read: the news is the attribution, not the malware. AI-assisted tooling does not change what a hardened, segmented, patched PLC looks like from the outside, and this advisory quietly admits that by prescribing the same fundamentals CISA has pushed all summer. What it does change is the attacker pool. When the barrier drops from “expert who can write ICS exploits” to “operator who can prompt for one,” the number of people who can reach an exposed water-plant controller goes up, and the window between a public flaw and a working tool shrinks. The right response is not to panic about AI; it is to close the exposure that made your controllers findable in the first place, and to assume the reconnaissance the agencies describe is already underway against anything you left facing the internet.

Primary Documents

• CISA/NSA/FBI/DOE/EPA Joint Cybersecurity Advisory AA26-231A: Defending Against an Active Threat to Siemens S7 Series PLCs
• Advisory PDF (media.defense.gov)
• The Record: NSA, FBI warn of hackers using AI-generated tools against critical infrastructure
• CyberScoop: AI-fueled attacks pose ‘active threat’ to water, other sectors