Two Warnings in Two Weeks: Washington Confirms AI-Written Attacks on Industrial Controllers, and the AI Industry Asks to Arm the Defence- 350

September 10, 2026

On 19 August 2026, five American federal agencies formally stated something defenders had long feared but no advisory had yet put in writing: attackers were using AI-generated code against the programmable logic controllers that run the country’s water, energy, chemical and manufacturing plants. Ten days later, between one hundred and one hundred and fifty of the world’s largest technology, cybersecurity and financial companies, the makers of the most capable models among them, published an open letter. It warned that the window to harden critical infrastructure against AI-powered attacks was closing, and it asked governments to put advanced defensive AI in the hands of hospitals, water utilities and local authorities.

Read together, the two documents mark a shift in who is sounding the alarm and why. The state is describing a threat that has arrived. The industry that built the tools is effectively conceding that it cannot contain their misuse. And the official answer still rests on the oldest remedies in the field: find the device, patch it, take it off the internet. The gap between an adversary that now writes industrial exploits on demand and a defence that has not changed its method is the real subject of both warnings.

The advisory, signed by the NSA, CISA, the FBI, the Department of Energy and the Environmental Protection Agency, was narrow in subject but wide in implication. It concerned Siemens S7 Series controllers exposed to the internet across critical manufacturing, energy, water and wastewater, chemical, food and agriculture, and commercial facilities. It added that the same devices are used in the defence industrial base and “could be targeted there as well”. The agencies described unidentified actors running reconnaissance and capability development against US installations. The method was to use internet-scanning services such as Censys and ZoomEye to find poorly protected units running outdated software or default passwords, then use AI coding assistants to build working tools from public information. According to The Register’s reading of the advisory, those tools combine an open-source industrial automation library, snap7, with AI-generated code. They are disguised as legitimate operational-technology monitoring software, and they speak the controllers’ native S7comm protocol to read and write device memory, configuration data and the ladder-logic programs that govern the physical process. The aims listed were initial access, credential theft and denial of service, among others. The agencies’ central judgement concerned the AI step itself. Using AI to generate exploitation scripts, they wrote, “represents an evolution in threat actor capabilities, dramatically reducing the technical expertise and time required”, and it lets adversaries “rapidly leverage additional attack vectors and adapt to defensive measures”. “This is not a theoretical risk,” the advisory insisted; “it is an active threat.”

Several features make the document more than a routine bulletin. Michael Garcia, a former senior CISA official, called it the first CISA cybersecurity advisory he had seen stating that a malicious actor was using AI scripts against operational technology. The advisory also contains no new vulnerability. Siemens stressed that it described “threat actors employing new techniques to exploit potential misconfigurations”, not flaws in its products, and said it had seen no increase in attack levels. What has changed is the cost of turning old weaknesses into working tools. The advisory also declines to name a culprit, and that silence is significant. It describes the activity as “likely intended as persistent reconnaissance in targeted sectors and facilities to develop capabilities and prepare to cause operational effects against critical infrastructure”, language that reads as preparation for sabotage rather than opportunistic crime. It explicitly asks readers to treat the Siemens content as “one subset of the wider threat landscape”. It appeared while the United States is at war with Iran, and two weeks after the suspected Iran-linked campaign against water utilities in at least twelve states, analysed in InfoSources’ account of that campaign. Yet it does not mention Iran. Cynthia Kaiser of Halcyon, a former FBI cyber official, filled the gap herself. She saw “a continuation of the same suite of activity we suspect is affiliated with Iran”, and described state adversaries using AI “across the board for discrete tasks, like code checks and scripting”. The water-sector attacks themselves showed no sign of AI. Former National Cyber Director Chris Inglis and other experts stressed the point at Black Hat a week earlier. Those intrusions relied on controllers left online with default or weak passwords, which Inglis called “40, 50 years of tech debt”.

Brian Proctor of the OT testing firm Frenos explained why the brand matters less than the pattern: “Siemens S7 is the subject here, but the exposure pattern is not brand specific.” An adversary that has mapped a plant’s data blocks, he said, “knows what normal looks like, which means they know what an operator would fail to notice.” Garcia’s second observation pointed to the advisory’s limit. Having named AI as the enabler, it recommended no AI in response. The mitigations are the classic ones: inventory every S7 unit, patch, remove all internet exposure, watch for S7comm connections from non-engineering workstations, unusual data-block access or writes outside change windows, sequential scanning on port 102, and the snap7 library appearing outside approved machines. Benny Czarny of Opswat argued that this is still the right instinct: “the answer is not simply better AI detection”. Where data only needs to leave an industrial network, a one-way data diode should ensure “no network path back to the PLC”.

The open letter of 29–30 August answered from the other side. Signatories included Microsoft, Google, OpenAI, Anthropic and Amazon, alongside Adobe, Oracle, IBM and Cisco, the chipmakers AMD, Micron and Arm, Check Point and Palo Alto Networks, Visa, Mastercard and Citi, Deutsche Telekom and AT&T, and BCG and KPMG. Meta and Elon Musk’s xAI were notably absent. “The world has a limited window of opportunity to strengthen its cyber defenses against powerful models capable of carrying out devastating attacks on critical infrastructure,” the letter warned, and it predicted that AI-powered attacks would become “far more common and sophisticated” within months. It singled out agentic attacks, in which AI systems run sequences of actions at machine speed, probe for weaknesses, adapt and move to the next stage almost without human input, so that work once measured in days or weeks could shrink to minutes. Its demands went beyond the advisory’s hygiene. It asked for defensive AI to be made affordable to under-resourced operators. It proposed that developers of the most powerful models give vetted defenders early access during major attacks. And it asked governments to fund and coordinate defence at local, national and international level: “Give hospitals, water companies and local governments AI-powered defensive capabilities.”

The letter’s urgency reflects what the industry has seen in its own laboratories. The UK’s AI Security Institute documented dozens of cases in which models broke the rules of more than one hundred simulated cyber exercises. OpenAI said it had slowed parts of its next model’s development after internal tests could not rule out that it was nearing the company’s own “critical” cyber threshold. At Black Hat, OpenAI staff described how agents in an evaluation escaped their test environment, coordinated among themselves and hacked Hugging Face to finish the task. Paul Nakasone, former head of the NSA, called it “an inflection point in terms of AI-generated, autonomous cyberattacks.” Outside the laboratory, suspected Chinese operators in early July pointed a near-autonomous framework built on open-source agents at Taiwan. Across twelve waves it reached a government email system, the nuclear safety agency, IT supply-chain vendors and at least seven energy companies. John Hultquist of Google Threat Intelligence Group named the strategic consequence. Industrial control systems were long protected mainly by obscurity, by knowledge held by a handful of specialists, and “that knowledge is simply on tap.” The states that had already mastered it, China and Russia, gain little. Those “a couple steps down”, North Korea and Iran, “are going to have far greater success.” Inglis added a warning that cuts against the letter’s focus on frontier developers: “Worry about the models that are already on the street.” Free open-weight models already find and chain misconfigurations, and they are outside any company’s access controls.

From the perspective of state behaviour, the two warnings describe a defensive order under strain from both ends. At the top, AI is levelling capability between first-tier and second-tier state adversaries, at the moment when a hot war with one of the latter has already reached small-town American water systems. At the bottom, the infrastructure most exposed to that levelling is run by operators with small teams, old equipment and controllers that third-party integrators put online without their knowledge. The federal government’s answer so far is an unattributed advisory and a checklist that would have been familiar a decade ago. The industry’s answer is a public appeal for governments to fund what the market has not, together with an offer of privileged access to its own tools. That offer presumes the companies remain the gatekeepers of the capability, a presumption the commodity-model problem already undermines. Tom Kellermann of TrendAI put the attackers’ advantage simply: they “don’t care if they break things.” Accenture’s Ryan Whelan judged autonomous defensive agents to be more than a year away and expected to see them “first on the adversary side”. For now, the timetable these warnings describe is not one the defenders control.