Attacking a Factory Controller Used to Require a Specialist. Now It Requires a Prompt.

The advisory names no vulnerability, no group, and no zero-day

On 19 August 2026 five United States agencies put their names to a joint warning about Siemens S7 Series programmable logic controllers, the small industrial computers that open valves, run pumps and hold conveyor lines in sequence. The advisory lists no CVE identifier. It attributes the activity to nobody. It describes no previously unknown flaw. What it does describe is that attackers are now generating their attack tools with AI, and that this alone was enough to bring together the NSA, CISA, the FBI, the Department of Energy and the Environmental Protection Agency.

That absence is the story. Everything the actors are exploiting has been sitting in plain view for years: known vulnerabilities, default passwords, controllers wired to the open internet. The one genuinely scarce ingredient was somebody who knew how to talk to the hardware. That is the ingredient that stopped being scarce.

What the agencies actually observed

The advisory, AA26-231A, covers the S7-200, S7-300, S7-400, S7-1200 and S7-1500 families, including the F-series safety controllers whose entire job is to shut a process down when something goes wrong. Six sectors are named as most affected: critical manufacturing, energy, water and wastewater, chemical, food and agriculture, and commercial facilities, with possible exposure in the defence industrial base. The agencies assess the activity as reconnaissance and capability development, which is to say the actors are mapping and rehearsing rather than breaking anything yet. Tenable, which published a technical breakdown the next day, notes the tooling is functional and in active use rather than theoretical.

The chain deserves a slow walk, because none of its parts are exotic. The actors begin with commercial internet scanning services, the search engines that continuously index every device answering on a public IP address, and filter for controllers responding on TCP port 102. That port carries S7comm, the protocol Siemens equipment uses to talk to engineering software. They then take snap7 and python-snap7, open-source libraries anyone can download that exist so engineers can build legitimate monitoring tools, and use an AI assistant to generate custom scripts on top of them. The result reads and writes the controller's memory, its configuration, and its ladder logic, meaning the program that governs what the machine physically does. It is dressed to look like ordinary monitoring software, and default or weak credentials handle the rest. Writing an S7comm tool by hand used to require real protocol expertise, acquired over years and held by comparatively few people. Generating one from a public library and a prompt takes an afternoon. MITRE has already assigned the step its own identifier in the ATT&CK framework, T1588.007, for AI-assisted development of exploit code.

• No zero-day is involved. The agencies point owners to Siemens ProductCERT for model-specific firmware rather than to a single patch, because there is no single flaw to patch.
• This follows advisory AA26-097A from April 2026, a separate campaign linked to Iran-affiliated actors who abused vendors' own engineering software against Rockwell, Schneider Electric and Siemens controllers. Same class of equipment, different technique, and both sets of mitigations apply.
• The agencies state plainly that the wider risk extends past Siemens to PLCs from every manufacturer.

Why it matters

Nothing has been destroyed yet, and the agencies are explicit that what they see is preparation. The concrete consequence so far is a list: five controller families, six sectors, and an unknown number of American plants and utilities where somebody has already read a configuration and tested a write. For your own organisation the useful shift is in the question you ask. It was long reasonable to assume that an obscure industrial protocol on a fifteen-year-old controller was unattractive, because attacking it demanded a specialist who had better-paid things to do. That assumption quietly underwrote a great many deferred segmentation projects. The question now is only whether the device answers from the internet, because everything after that is generated. If your OT network is maintained by an integrator whose remote access path you have never audited, that path is your answer, and you do not currently know it.

The systemic layer arrived two weeks later. On 1 September 2026 the White House launched Project Watershed 250, a six-month pilot in Texas run with the EPA, CISA and Texas Cyber Command, offering participating water utilities red-team testing and AI-assisted defensive tooling from Microsoft, Palo Alto Networks, Dragos and Tenable at no cost. The United States has roughly 150,000 water systems, most of them small and rural, many run by a handful of operators. Alison King of Forescout put the logic in one line: resource-constrained cannot mean defenseless. Read the advisory and the pilot together and the shape is clear enough. Once the cost of producing an attack tool collapses, defence has to be subsidised, because the operators newly in range were never going to fund it themselves.

What to do about it

1. Block TCP port 102 at the perimeter and verify there is no routing between corporate and OT networks. Internet reachability is now the entire selection criterion, because these actors are picking targets from scan results rather than by value.
2. Hunt for snap7.dll and python-snap7 running anywhere outside your approved engineering workstations. That library is the fingerprint of the generated tooling, and it has no legitimate reason to appear on a general-purpose host.
3. Restrict TIA Portal and STEP 7 to allowlisted engineering workstations, enable PLC password protection, and require multi-factor authentication (a second login step beyond the password) for remote access into OT. Default and weak credentials are what turns a reachable controller into a writable one.

Bottom line

The detail worth carrying out of this is that the advisory names no flaw. Five federal agencies issued a warning about a change in who can attack, not in what can be attacked, and the mitigations they recommend are the same ones that have been recommended for a decade. Obscurity was doing more defensive work in industrial environments than anyone wrote down, and it has now been repriced. Take that to your next security meeting as an inventory question rather than an AI question: which of our controls currently depend on an attacker having to know something rare?