When AI Lowers the Bar for Industrial Attacks: Defending OT in the Age of Generated Exploits

AI is making it easier for cybercriminals to launch attacks on industrial control systems (OT). A new government advisory published in August 2026 confirms that artificial intelligence (AI) is being used to generate code and exploit vulnerabilities in Siemens programmable logic controllers (PLCs). The advisory, signed by the NSA, CISA, the FBI, the Department of Energy, and the EPA, explains that attackers find exposed PLCs through internet scanning tools, then use AI to create Python scripts that communicate using the S7comm protocol.

These scripts can read and even write to PLC memory, potentially disrupting industrial processes or causing safety incidents. The advisory does not reveal any new vulnerabilities, but rather highlights the exploitation of poor configuration and exposure. The attack chain involves four stages: discovery, script generation, disguise, and access.

To defend against these threats, organizations must remove PLCs from direct internet access, segment OT from IT networks, inventory and classify controllers, enforce strong authentication, monitor for anomalous activity, and consider replacing unpatchable hardware. The convergence of AI and OT is already a reality, and organizations must adapt their security strategies accordingly.