Five US federal agencies issued a joint advisory on Wednesday warning that attackers are using AI coding assistants to build working intrusion tools against internet-exposed industrial controllers, and that the campaign is already running at water, energy and manufacturing sites. The alert from the NSA, CISA, FBI, Department of Energy and Environmental Protection Agency puts it bluntly: this is not a theoretical risk, it is an active threat.
The method is unglamorous, which is exactly what makes it consequential. Attackers pair the freely available snap7.dll library and its python-snap7 binding with AI assistants to generate Python tooling that reaches Siemens S7 Series controller memory, configuration data and ladder logic over the S7comm protocol, then disguise the result as ordinary operational technology monitoring software so it draws no attention on the plant network.
What the Advisory Describes
Active targeting spans the S7-200 through S7-1500 families across critical manufacturing, energy, water and wastewater, chemical, food and agriculture, and commercial facilities, with the agencies flagging that the same controllers sit in the Defense Industrial Base and that PLC targeting is broader than Siemens hardware alone. Discovery requires nothing exotic — commercial scanning services such as Censys and ZoomEye surface controllers left reachable from the public internet with unpatched high-severity flaws, stale firmware or default credentials intact.
The agencies characterize what they are seeing as persistent reconnaissance rather than immediate sabotage, the sort of positioning that precedes data theft, equipment damage, extended downtime or a safety incident.
The Real Change Is Deskilling
Nothing here describes a new vulnerability class, and that is the part worth sitting with. Attacking a PLC has historically required someone who understands ladder logic, industrial protocols and the physical process behind the controller, and that narrow talent pool functioned as an informal defense for OT environments for two decades. A code assistant that turns public protocol documentation into a working S7comm client erases that barrier, which is why the agencies frame AI use as an evolution in capability rather than a new exploit.
The strategic implication is uncomfortable for defenders. Much of OT security has quietly rested on attack difficulty rather than on device security, because the controllers themselves were designed for isolated networks in an earlier era and often cannot be hardened in place without halting production. When tooling cost falls toward zero, an exposure that was survivable last year stops being survivable, and the risk calculus that justified deferring a segmentation project no longer holds.
Water utilities are where that math breaks first. They run the same industrial hardware as a chemical plant on a fraction of the staffing and capital budget, frequently without a dedicated security team, and the consequences of manipulation are physical and immediate. That is not incidental to the timing of this advisory.
Attribution stays deliberately vague in the alert, though the surrounding context is not. Cynthia Kaiser, a former FBI cyber division deputy assistant director now at the Halcyon Ransomware Research Center, told The Register the activity resembles a continuation of suspected Iran-affiliated PLC targeting, pointing to intrusions at water and wastewater facilities in at least a dozen states and a July incident that disrupted more than 30 Minnesota community water systems. US agencies had already warned in April that Iranian-linked operators were hitting exposed Rockwell Automation and Allen-Bradley controllers.
What Operators Are Told to Do
The immediate instruction is an inventory of every S7 Series controller in the environment, followed by patching and the removal of any internet reachability. For detection, the agencies point to sequential IP scanning on port 102, repeated connection attempts with varying parameters, S7comm sessions from non-engineering workstations, unusual data block access, writes outside approved change windows, and snap7 library use on machines that have no reason to run it.
Benny Czarny, CEO of critical infrastructure security firm Opswat, argued that architecture matters more than detection here. Where data only needs to leave an OT network, he recommends a data diode so no return path to the controller exists at all, and warns against relying on antivirus and sandboxes to police the flow.
AI makes this more urgent. But the real lesson for me is still the same: stop giving attackers a path to the critical system in the first place.
That advice predates AI by years, and its reappearance in a 2026 federal advisory is its own verdict on how little of it was taken. The advisory does not ask operators to detect AI-generated code, which would be a losing game; it asks them to close the network paths that make the code useful.
