Five Federal Agencies Warn AI Is Lowering the Bar to Attack Critical Infrastructure. Here’s What Still Works

Five federal agencies just told the country something worth reading twice. The NSA, CISA, FBI, Department of Energy, and Environmental Protection Agency issued a joint warning this month describing attackers who use artificial intelligence to build exploit scripts aimed at Siemens S7 programmable logic controllers (PLC), the small industrial computers that run pumps, valves, and switches across factories, power plants, and water systems. The agencies made their language direct, describing the scanning and script-building in the advisory as active reconnaissance happening across U.S. facilities right now.

Michael Garcia, a former senior CISA official who now leads cybersecurity practice at Monument Policy Advocacy, says he has not seen an alert quite like this one. Federal agencies have flagged industrial control system risks for years. Naming AI-generated code as the tool behind this reconnaissance is new, and Garcia's assessment carries weight from his years writing these warnings himself.

Siemens S7 controllers sit inside the physical machinery that keeps modern life running, opening valves at water treatment plants, managing temperature in chemical processes, and controlling switches on factory floors. A PLC tells a physical device what to do next, which is why a compromised one matters so much. Andrew Costis, an engineering manager on the adversary research team at AttackIQ, frames the stakes plainly: “PLCs sit much closer to the physical processes that keep critical infrastructure running.” A breached email account exposes information. A breached PLC can move something in the physical world.

What Investigators Found

According to the advisory, attackers scanned the internet using tools like Censys and ZoomEye to find S7 controllers exposed online, the industrial equivalent of leaving a factory door unlocked and searchable by anyone. They then used AI to write Python scripts disguised as ordinary monitoring software, repurposing legitimate open-source libraries built for talking to S7 devices to read memory and configuration data without permission.

Jon Braley, director of threat intelligence at IT-ISAC and Food and Ag-ISAC, names the specific weakness that makes this possible. Many industrial protocols, including the ones these PLCs speak, were built decades ago without authentication or encryption built in, so a script that speaks the right language gets treated as if it belongs on the network. Braley traces many of these incidents to weak security processes and hardware that is difficult to maintain, a longstanding problem AI now lets attackers exploit faster.

The agencies described the activity as reconnaissance and capability testing, meaning attackers are mapping targets and refining tools now, ahead of any disruptive attack. Named sectors include critical manufacturing, energy, water and wastewater systems, chemical production, food and agriculture, and commercial facilities. No victim organization has been named publicly, and no group has been formally attributed to the activity.

This warning is separate from the ransomware crews hitting hospitals and utilities this year, and separate from the Iran-linked group blamed for a water utility disruption in Minnesota this past July. Both point to the same underlying lesson: physical infrastructure is drawing more attention from more capable adversaries, and AI is part of why.

Why AI Changes the Math Here

Security researchers have flagged weaknesses in industrial protocols like the one Siemens S7 devices use for well over a decade. The specialized skill required to turn a known weakness into a working exploit is what kept the attacker pool small for years.

Andrew Faulhaber, a visiting fellow with the Intelligence, National Security, and Technology Program at the Center for Strategic and International Studies, has written about exactly this shift. He warns that large-scale AI-assisted cyberattacks are reaching beyond nation-state hacking teams, toward “terrorist organizations and individual actors as well.” One AI model reached a 73 percent success rate on capture-the-flag challenges built to simulate hands-on intrusion work. Faulhaber’s conclusion is direct: AI is set to profoundly alter the cyber world security teams operate in.

AI turns a known protocol weakness into a working script in far less time, putting that capability within reach of people who never had to learn the protocol themselves.

The Good News Hiding Inside a Scary Headline

Here is the part that gets lost in a warning this alarming. Every mitigation the agencies recommended is something security teams already know how to do. The urgency behind doing it now is what changed.

The advisory calls for:

• Taking exposed PLCs off the public internet
• Blocking port 102, the channel S7 devices use to communicate, at the network perimeter
• Separating operational technology from business systems
• Restricting programming access to authorized engineering workstations
• Enabling password protection and write protection on every controller

Patching gets more careful treatment, and for good reason. The advisory is direct that no single patch resolves every risk it describes. Firmware updates vary by controller family, so Siemens directs organizations to its own ProductCERT for the specific update each model needs, prioritizing internet-facing controllers first and testing in a non-production environment before touching a live process. That sequence takes longer than pushing a software update to a laptop, which is exactly why the other controls above matter just as much as the patch itself.Every one of those steps depends on an organization knowing which PLCs it has, where they sit on the network, and whether they are reachable from the internet, and plenty of industrial operators still cannot answer that question with confidence today. Dan Kambic, a researcher with Carnegie Mellon University’s Software Engineering Institute, has written about the same fix for industrial control systems broadly, recommending organizations enforce least privilege by "limiting the users that can establish remote connections to only those necessary." Pairing that visibility with strict access rules, so only one approved computer can reprogram a given controller, shuts the door that scanning and reconnaissance are meant to open.

Why Training Matters Just as Much as Technical Controls

Engineers and operators are often the last line of defense against a phishing email, a spoofed vendor call, or a fraudulent request that looks routine on a busy day. AI has made those attempts sharper and easier to produce at scale. Fred Heiding and Alex O’Neill, researchers at Harvard Kennedy School’s Belfer Center for Science and International Affairs, have found that AI tools can cut the cost of running a convincing spear phishing campaign by as much as 99 percent, putting that kind of attack within reach of far more people than before. Training that helps someone spot a fabricated urgent request matters as much in a control room as in a corporate office. Security awareness built for industrial teams adds a second layer of defense alongside network segmentation.

A Short List for This WeekSecurity teams can move on several fronts starting now, using the budget and timeline already in place.

• Building a complete inventory of every Siemens S7 device on the network, including which ones are reachable from the internet, gives a team the map it needs before it can act on anything else.
• Segmenting operational technology networks from business systems, and monitoring both for unusual activity, catches problems while they are still small.
• Sharing this advisory with system integrators, equipment vendors, and maintenance providers closes a gap many organizations overlook, since outside vendors often carry access that deserves the same scrutiny as an employee's.

Each step closes a different door. Together, they make an exposed PLC a far harder target before a patch even ships.

Shared Infrastructure Deserves Shared Defense

Water treatment plants, power substations, and food processing facilities share the same exposure, and so do the threats against them. A script built to exploit one exposed Siemens controller can be aimed at thousands of similar devices across industries and states. That shared exposure is why this advisory came from five agencies acting together, and why the fix depends on the same cooperation among equipment vendors, plant operators, and security teams.

AI gave more people the tools to find the vulnerability inside an exposed PLC. Organizations that turn this advisory into a checklist will be the ones still standing when the next one arrives.