US Agencies Warn AI-Generated Code Targets Critical Infrastructure PLCs
A joint alert from the NSA, FBI, and other agencies warns that AI coding assistants are lowering the barrier for attackers to compromise industrial controllers.
Five US federal agencies—the NSA, CISA, FBI, DOE, and EPA—have issued a joint warning that attackers are leveraging AI coding assistants to target critical infrastructure. The alert emphasizes that this is an active threat to essential services rather than a theoretical risk.
The attacks specifically target internet-exposed Siemens S7 Series programmable logic controllers (PLCs), which manage physical processes in the water, energy, manufacturing, and chemicals sectors. According to the federal advisory, attackers combine AI-generated scripts with open-source industrial automation libraries, specifically snap7.dll and python-snap7. This combination allows adversaries to gain unauthorized read and write access to PLC memory and critical configuration data.
The Attack Vector
To identify targets, attackers utilize scanning services such as Censys and ZoomEye. These tools locate poorly protected PLCs exposed to the public internet, which are often characterized by outdated software or the use of default passwords. Once a vulnerable controller is identified, AI assistants are used to rapidly develop and modify the exploitation scripts required to breach the system.
Lowering the Barrier to Entry
Historically, attacking industrial control systems (ICS) required deep, specialized knowledge of operational technology (OT). However, the integration of AI into the attack chain is fundamentally changing the risk profile. By automating the creation of complex scripts, AI reduces the need for advanced OT technical expertise and accelerates the development of ICS malware.
This shift allows adversaries to scale their operations more effectively, moving from highly targeted strikes to broader, more rapid campaigns. The ability to automate the modification of scripts targeting PLCs means the technical barrier to attacking industrial systems continues to fall, enabling a wider range of actors to execute these attacks.
Industry Implications
This evolution in threat tactics transforms the risk to the Defense Industrial Base and civilian utilities into a scalable, active threat. Because AI allows those without deep technical backgrounds to compromise systems that manage health, safety, and critical infrastructure, the potential for widespread disruption has increased significantly.
Mitigation and Outlook
While the joint federal alert does not attribute this specific AI-driven threat to a particular group, the warning aligns with a broader trend of adversaries leveraging AI for discrete scripting tasks. Security professionals are advised to prioritize the removal of PLCs from the public internet and the elimination of default credentials to mitigate these evolving risks.