Feds: AI Wrote the Exploit Code Hitting US Water Plants

On August 19, 2026, five US agencies (CISA, the FBI, the NSA, the Department of Energy, and the EPA) issued a joint advisory that confirms something security researchers had warned about for a while: hackers are now using AI to write the exploit code that attacks industrial equipment. The advisory says threat actors are generating Python scripts with AI to break into Siemens S7 series programmable logic controllers (PLCs), the small industrial computers that run pumps, valves, and safety systems at water plants, power facilities, and chemical plants across the country.

This is the first time a US government cybersecurity advisory has stated, in plain terms, that AI-generated code is behind an active attack campaign against critical infrastructure. That is the headline fact. What it means in practice is narrower, and more useful, than the headline suggests.

What the attackers actually did

The campaign is tied to CyberAv3ngers, a group linked to Iran’s Islamic Revolutionary Guard Corps, that US authorities have tracked targeting industrial control systems since at least November 2023. The advisory describes a fairly mechanical process. Attackers scan the open internet with services like Censys and ZoomEye to find Siemens S7 PLCs that expose port 102, the network port these controllers use for a legitimate management protocol. Any PLC that answers on that port from the open internet is a candidate target.

Once a target is found, the attackers use AI tools to generate Python scripts built on two existing libraries, python-snap7 and snap7.dll, that already know how to speak the Siemens communication protocol. The AI-written scripts read data blocks off the controller to figure out what industrial process it is running, then can write modified values or altered ladder logic back to it. Some of these scripts are disguised as legitimate operational-technology monitoring software, which makes them harder to flag on sight.

The advisory’s most concrete example happened before the advisory itself: over two nights in late July, attackers hit more than 30 community water and wastewater systems in Minnesota, briefly shutting down one city’s treatment plant and triggering a state-wide emergency response involving the FBI, CISA, and the EPA. Utilities in at least a dozen states, including Michigan, Georgia, South Dakota, and New Jersey, have seen related activity. The named sectors extend beyond water to energy, chemical manufacturing, food and agriculture, and general critical manufacturing.

What’s actually new here, and what isn’t

It’s worth separating two things the advisory is describing, because only one of them is new. Attacking internet-exposed PLCs over port 102 is not new. Security researchers have flagged this exact exposure for over a decade, and this same Iran-linked group has been doing versions of this since 2023, using earlier advisories that named Schneider Electric and Rockwell Automation controllers alongside Siemens. The vulnerability is not a flaw in the PLC’s code. It is a decades-old operational mistake: a device that was never supposed to be reachable from the public internet, reachable from the public internet.

What changed is the labor cost of writing the exploitation script for each new target. Before, an attacker needed someone on the team who already understood the Siemens S7 protocol well enough to write a working read/write client by hand. Now, an AI model that has been trained on a large amount of public code, including the python-snap7 library’s own documentation and examples, can produce a working script from a much shorter description of the goal. That collapses a step that used to require a specific, fairly rare skill into something closer to describing the outcome you want.

That is a real shift, but it is a narrower one than “AI is now hacking infrastructure.” The attackers are a sophisticated, state-linked group that already had the intent, the target list, and the scanning infrastructure. AI did not give them a capability they lacked; it let them produce working exploit code faster and for more targets in the same amount of time. The barrier that mostly held here, and continues to hold, is the one this advisory keeps returning to: don’t expose the controller to the internet in the first place. That fix has nothing to do with AI and everything to do with basic network segmentation that many utilities, often small and underfunded, still haven’t done.

Where this fits with the rest of this month’s AI-safety news

This advisory lands in the same month as OpenAI’s own account of pausing frontier training after an internal model crossed its “Critical” cyber-capability threshold in lab testing. Read together, the two stories describe the same underlying trend from opposite ends. OpenAI’s report is about a lab discovering, in a controlled setting, that a model got good enough at chaining exploits that the company felt it had to change its own training process. This week’s advisory is about a real attacker using an off-the-shelf AI tool, in production, to do a narrower version of the same kind of work against real facilities.

Neither story means AI is autonomously running cyberattacks end to end. Both describe the same practical effect: the software-writing part of an attack, which used to gate who could carry one out, is getting cheaper to produce. The remaining defenses are the unglamorous ones this advisory recommends: get PLCs off the open internet, monitor for the scanning behavior that precedes an attack, and treat any internet-facing control-system device as an active liability rather than a convenience.

Sources: CISA Advisory AA26-231A, The Hacker News, BleepingComputer, TechCrunch, Help Net Security