Five US Agencies Warn of AI-Generated Exploit Scripts Probing Siemens S7 PLCs (AA26-231A)

Internet-exposed Siemens S7 series programmable logic controllers across every generation from the S7-200 to the S7-1500 F-series safety controllers, in US critical manufacturing, energy, water and wastewater, chemical, food and agriculture, and commercial facilities

The NSA, CISA, the FBI, the Department of Energy, and the Environmental Protection Agency issued joint advisory AA26-231A describing ongoing reconnaissance and capability development against US industrial control systems, carried out with AI-generated exploitation scripts disguised as legitimate operational-technology monitoring tools. The actors use internet scanning services to locate exposed PLCs running outdated firmware or otherwise poorly protected, then pair the open-source `snap7.dll` and `python-snap7` libraries, which are ordinary industrial automation tooling, with AI-assisted scripting to produce custom implements that speak S7comm on TCP port 102 and reach PLC memory, configuration data, and ladder logic programs. The agencies' assessment is that generating exploitation scripts with AI materially lowers the expertise and time needed to build working ICS tooling and lets adversaries pick up additional attack vectors and adapt to defenses faster than before. This is a government confirmation, not a vendor claim, that AI-written offensive code is in use against critical infrastructure

Exposed control systems with weak or absent authentication, reachable with legitimate automation libraries, combined with a model that turns protocol documentation into working attack scripts for an operator who could not previously write them