U.S. federal agencies have issued the first explicit advisory on active attacks using AI-generated code against industrial control systems. The CISA advisory describes attackers using AI coding assistants to write Python scripts that exploit Siemens S7 PLCs in water utilities and energy facilities as fake monitoring software. It states: “This is not a theoretical risk. It is an active threat.”
The advisory is correct, but the vulnerability predates the AI component. Critical industrial systems have sat on the internet with weak authentication for years. Attackers found them using Censys and ZoomEye. AI-generated code removed the expertise barrier, making exploitation easier. The core problem is decades of negligent infrastructure.
Isolate these systems from the internet and enforce strong authentication.
Sources: Defending Against an Active Threat to Siemens S7 Series PLCs
Coverage: ‘Not a theoretical risk,’ feds warn as attackers use AI-made code to hack critical infrastructure controllers • US warns of AI-powered attacks on Siemens PLCs in critical infrastructure • AI-fueled attacks pose ‘active threat’ to water, other sectors, U.S. agencies warn
Related on this blog: [AUTO] Langflow RCE Added to KEV After a Month of Silence • [AUTO] AI Phishing Defenses Outpaced by AI Attack Volume • JADEPUFFER’s 19-Day Upgrade: Ransomware Built to Destroy AI Models