Five U.S. agencies are warning that hackers are using AI-generated scripts to hunt for exposed Siemens industrial controllers.
The NSA, CISA, FBI, DOE, and EPA issued a joint advisory on August 19, 2026, describing an active threat to Siemens S7 Series programmable logic controllers, from the older S7-200 line through current S7-1500 models. According to the advisory, threat actors use internet scanning services such as Censys and ZoomEye to find PLCs that are exposed online or running outdated software. They then deploy AI-assisted Python scripts built on the open-source snap7 library to read and write PLC memory, configuration data, and ladder logic over the S7comm protocol, while disguising the tools as legitimate OT monitoring software. The agencies say the sectors most targeted include critical manufacturing, energy, water and wastewater, chemical, food and agriculture, and commercial facilities.
What stands out isn't that industrial controllers are exposed online again; security researchers have flagged that problem for over a decade. It's that AI is doing the hard part of ICS exploitation, generating working scripts against specific PLC models without the deep protocol expertise that once made this kind of attack a nation-state specialty. The agencies frame the current activity as reconnaissance and capability testing, meaning the read-access probing happening now could be laying groundwork for write-access disruption later.
The advisory's top mitigation is still the same one CISA has repeated since Stuxnet: keep the PLC off the internet. What's changed is that attackers now need a fraction of the expertise to act on that exposure.