U.S. Agencies Warn of AI-Assisted Attacks Targeting Internet-Exposed Siemens PLCs

The U.S. government has warned of an active cyber threat targeting critical infrastructure organizations using artificial intelligence (AI)-generated exploit scripts against internet-exposed Programmable Logic Controllers (PLCs).

The warning, issued by the NSA, CISA, FBI, Department of Energy, and Environmental Protection Agency, highlights activity targeting Siemens S7 Series PLCs for reconnaissance, exploitation, and capability development. The agencies said the activity is broader than Siemens devices alone and did not attribute it to a known threat actor.

AI-Generated Scripts Used Against Industrial Systems

According to the advisory, attackers are using AI assistance to create and modify exploitation scripts based on publicly available information about Siemens S7 PLCs.

The activity has focused on PLCs that are:

  • Exposed directly to the internet
  • Running outdated software
  • Poorly protected
  • Insufficiently segmented from other networks

Attackers are also using internet-wide scanning services such as Censys and ZoomEye to locate vulnerable industrial systems.

The targeted sectors include Critical Manufacturing, Energy, Water and Wastewater Systems, Chemical, Food and Agriculture, and Commercial Facilities.

The agencies warned that successful exploitation of exposed PLCs could result in disruption of industrial processes, operational downtime, equipment damage, sensitive-data exposure, and potentially serious safety consequences.

Siemens PLC Models Targeted

The activity has been observed targeting multiple Siemens S7 families, including:

  • S7-200 Series — all CPU variants
  • S7-300 Series — including 314, 315 and 317 models
  • S7-400 Series — all CPU variants
  • S7-1200 Series — including 1211C, 1212C, 1214C, 1215C and 1217C
  • S7-1500 Series — including F-series safety controllers

The agencies said attackers can exploit known vulnerabilities when these systems are accessible from the internet or insufficiently segmented.

Legitimate-Looking Python Tools Used for PLC Access

One of the tools observed during the activity is a custom Python script incorporating industrial automation libraries such as snap7.dll and python-snap7.

These libraries are legitimate components commonly used for interacting with Siemens PLC environments.

The scripts can provide access to functions involving:

  • PLC memory
  • Configuration information
  • Ladder logic programs
  • S7comm communications
  • Read/write operations

The use of legitimate industrial automation libraries makes the activity potentially harder to distinguish from authorized monitoring or engineering utilities.

The U.S. agencies said AI-assisted development allows attackers to rapidly generate and modify these scripts, lowering the technical barrier required to conduct attacks against industrial control systems.

"The combination of known vulnerabilities, accessible exploitation libraries, and AI-assisted development creates a high-probability attack scenario against inadequately protected PLC installations."

Why AI-Assisted ICS Attacks Are Significant

The agencies described the use of AI-generated exploitation code as an evolution in offensive capabilities.

Traditionally, attacking industrial control systems requires specialized knowledge of PLC protocols, industrial environments, and vendor-specific technologies.

AI assistance can reduce the time required to:

  1. Research publicly available PLC information
  2. Generate exploitation code
  3. Modify scripts for different devices
  4. Automate reconnaissance
  5. Test attack techniques
  6. Adapt tooling to different environments

This does not necessarily mean the entire attack is autonomous. Instead, AI can accelerate individual stages of an operation and allow attackers with less specialized expertise to develop usable tooling more quickly.

Recommended Defensive Measures

The agencies urged organizations operating Siemens PLCs and other industrial control systems to prioritize basic OT security controls.

Organizations should:

  • Keep PLC firmware and software updated
  • Remove PLCs from direct internet exposure
  • Segment OT and IT networks
  • Implement strong authentication and access controls
  • Restrict access to industrial protocols
  • Monitor PLC communication for unusual activity
  • Review firewall and remote-access configurations
  • Monitor for unexpected PLC configuration changes
  • Investigate suspicious scanning and authentication activity
  • Maintain secure backups of PLC configurations

Organizations should also review whether industrial devices can be reached from the public internet and whether remote engineering access is properly restricted.

AI-Powered Multi-Agent Attack Also Targeted Taiwan

The warning comes as other research shows attackers increasingly experimenting with AI-powered systems to automate cyber operations.

Israeli cybersecurity company Dream recently documented a near-autonomous attack campaign targeting government entities in Asia. Taiwan's Ministry of Digital Affairs subsequently confirmed that the country had been targeted by an AI-driven hacking campaign.

The activity took place between July 1 and July 4, 2026, across 12 attack waves.

According to the research, the attackers used an AI-powered framework built around Hermes and OpenClaw, deploying multiple specialized sub-agents simultaneously.

The agents were assigned different tasks, including:

  • SSO exploitation
  • Credential attacks
  • JWT bypass testing
  • CAPTCHA bypass
  • Reconnaissance
  • API scanning
  • Administrative-panel testing
  • CVE research
  • Supply-chain assessment
  • Password spraying
  • Deep API exploitation

AI Agents Automated Different Attack Stages

The framework reportedly used multiple lettered agents operating concurrently.

These included agents focused on:

A: SSO exploitation and credential attacks

B: JWT bypass and CAPTCHA brute-force testing

C: Reconnaissance across government portals

D: API scanning and administrative-panel bypass

E: Vulnerability research and exploit-chain testing

F: Supply-chain target assessment

I: Password spraying and CAPTCHA bypass using Tesseract OCR

Q: Deep API endpoint exploitation

The multi-agent approach allowed the attackers to investigate several attack surfaces simultaneously rather than relying on a single sequential workflow.

Government Credentials and Data Compromised

According to Dream, the framework identified hidden API endpoints that returned valid authenticated sessions regardless of the request body.

The attackers reportedly used these endpoints to collect employee usernames and subsequently conducted password spraying against a government portal.

The campaign allegedly resulted in:

  • 85 compromised credentials
  • More than 2,564 personnel records exfiltrated
  • A database containing government system users
  • 7 SSO client secrets
  • 6 internal database credentials
  • Internal network IP ranges

The activity also expanded beyond the primary government targets.

Dream said the attackers investigated government IT suppliers, a nuclear safety agency, government email infrastructure, and more than seven energy-sector companies for exposed services, misconfigurations, and vulnerabilities.

AI Framework Used External Research

The AI framework reportedly incorporated a learning mechanism capable of searching vulnerability databases, GitHub repositories, and security research.

This allowed the agents to identify techniques relevant to the target environment and adapt their attack strategy.

Dream said the operation generated approximately 1,395 files, compromised 85 credentials, exfiltrated thousands of records, and established persistent access within roughly four days.

The Growing Risk to Critical Infrastructure

The two incidents highlight a broader change in the cybersecurity threat landscape.

AI does not necessarily need to independently conduct an entire cyberattack to create additional risk. Attackers can use AI to accelerate reconnaissance, vulnerability research, exploit development, credential attacks, and malware development.

For industrial environments, the consequences can be particularly serious because PLCs directly control physical processes.

An internet-exposed PLC that would previously have required significant specialist knowledge could increasingly become a target for automated discovery and AI-assisted exploitation.

The U.S. agencies therefore emphasized that network isolation, segmentation, patching, access control, and continuous monitoring remain essential defenses against AI-assisted attacks.

As AI-powered offensive tooling becomes more capable, organizations operating critical infrastructure will need to assume that attackers can discover and adapt to exposed systems faster than before.