AI-written exploits aimed at PLCs

The NSA, the FBI and other federal agencies issued an advisory on 19 August describing threat actors using AI-assisted development to build exploitation scripts for industrial control systems, dressed up as legitimate monitoring tools. The named target is the Siemens S7 series of programmable logic controllers, in the energy, water, agriculture and defence sectors.

The method described is unglamorous: scan the internet for exposed controllers, perform reconnaissance, then develop capability against what was found. The advisory does not attribute the activity, and characterises it as likely persistent reconnaissance intended to build capability in targeted sectors rather than to cause an effect now.

The claim being made about AI

The advisory's own framing is that this represents an evolution in capability because it dramatically reduces the expertise and time needed to produce a working ICS exploitation script. That is a claim about the supply of attackers, not about the sophistication of any single attack.

It is worth reading precisely. Nothing here suggests AI found a new weakness in an S7 controller. It suggests that writing an exploit for a known one no longer requires someone who has spent years learning industrial protocols — which changes who can participate, and how many of them there are.

The recommendations are the ones that have been made for a decade: take PLCs off the internet, patch what can be patched, turn on monitoring. The advisory adds urgency rather than novelty, and the experts quoted make the same point — reconnaissance precedes effect, and once access exists the rest is easier.