AI Is Writing Exploits for the Controllers That Run Water Plants. Five US Agencies Say the Attacks Are Live.

Five agencies, one advisory, and a sentence with no hedging in it

On 19 August 2026 the NSA, CISA, the FBI, the Department of Energy and the Environmental Protection Agency put their names on the same document. It concerns Siemens S7 programmable logic controllers, the small industrial computers that open valves, start pumps and run machinery inside water treatment plants, power stations and factories. On the status of the threat the agencies were unusually blunt. This is not a theoretical risk, they wrote. It is an active threat.

The part worth slowing down for is not that attackers are using AI to write code. Most people assumed that already. It is which particular barrier the AI dissolved, because industrial control systems have spent decades protected by something almost no security programme ever wrote down as a control.

What the advisory actually describes

Advisory AA26-231A names the sectors currently under reconnaissance: critical manufacturing, energy, water and wastewater, chemical, food and agriculture, and commercial facilities. The agencies add that these same controllers sit throughout the Defense Industrial Base. The device list covers effectively the entire S7 family, from the elderly S7-200 and S7-300 up to the S7-1500, and it explicitly includes the F-series safety controllers, whose whole purpose is to stop machinery when something goes wrong. No group and no country is named anywhere in the document. It refers throughout only to threat actors.

The mechanism is a chain of four fairly unremarkable steps, and the third one is the only new thing in it. The attackers begin by querying Censys and ZoomEye, commercial services that continuously catalogue every device answering on a public IP address, filtering for Siemens controllers running outdated firmware or otherwise poorly protected. They get in through default or weakly configured passwords, or through a known high-severity vulnerability that was never patched, often because patching a PLC means stopping the process it controls. Then they use AI to write custom Python tooling built on snap7 and python-snap7, the open-source libraries that speak S7comm, the protocol Siemens controllers use to talk to the software that monitors them. Those tools are dressed up to look like legitimate OT monitoring software, meaning the operational technology products a plant engineer would normally have installed, and they read PLC memory, configuration data and ladder logic, which is the program telling the controller what to do with each pump and valve. The agencies assess that the actors are using that read access to understand target environments and position themselves for write operations later.

• The advisory says the problem is wider than one vendor. Ongoing PLC targeting activity is broader than Siemens PLCs, it states, and all PLC owners and operators should apply the mitigations.
• There is recent precedent for the write phase. On 26 and 27 July 2026, more than thirty community water utilities across Minnesota had operational systems disrupted, with some plants reverting to manual operation. Researchers have linked that incident to the Iran-aligned group CyberAv3ngers on the basis of timing and targeting, and no agency has confirmed the attribution.
• The agencies ask asset owners to forward the advisory directly to their system integrators and third-party service providers, on the blunt reasoning that many owners do not know their own PLCs are reachable from the internet.

Why it matters

Nothing has been destroyed yet. What the advisory documents is preparation, and preparation is the honest word for it. The Minnesota utilities in July are what the next phase looks like in practice, and the presence of F-series safety controllers on the target list is worth reading twice, because those are the devices that exist to stop a machine before it hurts someone. Closer to home, the reason this campaign is hard to see has nothing to do with stealth. The attackers are using the same open-source library your system integrator uses, over the same protocol, to perform reads that look exactly like monitoring, which is what monitoring software does all day. Most OT environments have never treated a read from a PLC as an event worth an alert, and the entire operation currently lives inside that gap. It is also worth asking, this week rather than next quarter, who actually put your controllers on the internet, since in most plants the answer is a contractor who needed remote access in 2019 and the asset owner never knew. The systemic shift underneath all of this is the one the agencies name themselves. Industrial control systems were never really protected by segmentation, which is patchy almost everywhere. They were protected by scarcity: knowing S7comm, knowing which rung of ladder logic to alter to damage a pump without tripping an alarm, knowing what a chlorine dosing setpoint should look like. That knowledge lived in a small professional community, and its smallness was doing security work nobody had budgeted for or even noticed. The advisory records that using AI to generate exploitation scripts dramatically reduces the technical expertise and time required. That is the sentence to sit with, because expertise was the wall.

What to do about it

1. Build your PLC inventory from the outside in, not from your asset database. Query Censys and ZoomEye against your own address ranges and your integrators' ranges, because that is the exact list the attackers are working from, and it will include devices your internal records do not.
2. Alert on read access to controllers, not only on writes and configuration changes. The agencies' assessment is that today's reads are positioning for tomorrow's writes, so the reconnaissance phase is the only window where detection is still cheap and reversible.
3. Replace default and shared credentials on every controller and take them off the internet even where a vendor insists on remote access. There is no exotic step anywhere in this chain, which means it breaks completely if the device cannot be found or the password cannot be guessed.

Bottom line

Bring this one to your next security meeting as a question about your own inventory rather than as a headline about AI. Five federal agencies have told you which devices are being catalogued, by which scanning services, using which library, over which protocol. That is an unusually complete description of an attack that has not happened yet. The uncomfortable part is what it implies about the last thirty years, because the thing quietly keeping most industrial controllers safe was that very few people knew how to talk to them and nobody could be bothered to learn. That was never a security control. It was a shortage, and shortages end. Advisory AA26-231A sets out the affected models and the full mitigation list.