Five US agencies have issued a warning about an "active threat" involving activity that uses AI-generated Python scripts—built from publicly available information—to target internet-exposed Siemens S7 PLCs (programmable logic controllers). The joint cybersecurity advisory, AA26-231A, explains that attackers also leverage legitimate communication libraries, using tools disguised as monitoring software to read and write PLC data blocks.
The US agencies assess that the current activity is likely persistent reconnaissance or the testing and refinement of techniques. Read operations, they note, could be used to prepare for future write operations. There is no indication in the advisory that this specific campaign has resulted in changes to safety interlocks, equipment destruction, or disruption of water and sewage systems. Nor is this a warning that AI has autonomously destroyed a PLC.
The practical problem lies not in AI itself, but in the overlap of internet-exposed control equipment, known configuration weaknesses, and existing communication functions into a single attack pathway. AA26-231A is not a document announcing a single new CVE—it illustrates a chain of attacks that becomes possible in exposed OT environments.
Five US Agencies Name Five S7 Series
AA26-231A was jointly issued by five US agencies, including the National Security Agency (NSA). It names five affected series—Siemens S7-200, S7-300, S7-400, S7-1200, and S7-1500—with the S7-1500 F-series safety controller CPUs also included. The most targeted US sectors are critical manufacturing, energy, and water/wastewater. Chemical, food and agriculture, and commercial facilities are also included, and the advisory states that S7 units used within the defense industrial base could also be targeted.
However, the fact that five series are listed as targets does not mean all units can be compromised under the same conditions. US agencies confirmed activity searching for exposed PLCs—including those running outdated software—through internet search services such as Censys and ZoomEye. Insufficient network segmentation is also a target of this searching. Whether compromise is actually possible depends on individual configurations, including known critical vulnerabilities and weak authentication.
On August 21, Siemens updated product advisory SSB-104599 to version 1.3, adding a reference to AA26-231A and to the S7 family including the S7-400. The countermeasures Siemens lists include updating to the latest version, disconnecting from inadequately protected networks or adding firewalls, using strong and unique passwords, and following product-specific documentation for operations.
AI Shortened the Prototyping Process for Attack Code
According to US agencies, attackers fed publicly available information to AI to generate Python scripts incorporating public libraries in the snap7.dll/python-snap7 family. The tools disguise themselves as legitimate OT monitoring software, reading and writing to PLC data blocks—a staged approach of first understanding the environment through reads, then preparing for disruption through writes.
python-snap7 is a legitimate, open-source Python library for communicating with Siemens S7 PLCs. It provides functions for reading and writing data blocks and various memory areas, and is used in the development and operation of control environments. It is not itself a vulnerability or malware—rather, its legitimate functionality has been repurposed as an attack tool.
AI lowered the skill and time required to gather publicly available model and vulnerability information and iteratively build scripts using existing libraries. AA26-231A does not state that AI discovered unknown vulnerabilities, nor that it can unconditionally compromise all S7 units. Defenders must check not only whether AI was used, but also what public pathways exist to reach PLCs and what access conditions permit reading and writing.
In other words, AI has not eliminated the conditions required to reach a PLC. After exposed equipment is found, it has accelerated the process of adapting code to specific models and configurations. Network segmentation and access controls remain effective because even if attackers can build scripts, they cannot proceed to reading and writing without being able to connect to the target.
Between "Active Threat" and "Confirmed Destruction"
The US agencies assessed that the current activity is likely persistent reconnaissance across target sectors, development of attack capabilities against specific PLCs, and possible pre-positioning for future operational disruption. Potential impacts cited include disruption of critical processes and personnel safety incidents. Beyond equipment damage and extended downtime, the advisory also lists leakage of sensitive operational data, cascading effects, and regulatory non-compliance. However, this is a list of conditional potential impacts—not a record confirming that physical damage or operational disruption has occurred in this campaign.
AA26-097A, published in April and updated on July 22, documents activity by an Iran-linked APT connecting to internet-exposed PLCs from multiple manufacturers using vendor-native configuration software. The S7-1200 was among the targets, and in broader activity involving Rockwell, Schneider, and Siemens equipment, operational disruptions and financial losses occurred across multiple sectors. In similar activity by CyberAv3ngers since November 2023, at least 75 Unitronics PLC/HMI units were compromised, with observed activity replacing legitimate ladder logic with malicious code.
However, these are not confirmed damages from the current AI-generated script activity. It has not been publicly stated that the Iran-linked APT in AA26-097A and the unattributed attacker in AA26-231A are the same actor. Overlaying past damage or compromise counts onto the current campaign would confuse the "active threat" described in the advisory with confirmed destruction.
Closing Exposure Pathways Alongside Patching
AA26-231A prioritizes inventorying all S7 assets and firmware, applying critical patches, and removing PLCs from the internet. It specifically calls for blocking external exposure of TCP port 102 and reviewing access controls. Updates should be tested in a development environment before production deployment.
For operational monitoring, organizations should check for anomalous S7comm communications, changes to services or protocols, and the integrity of ladder logic. Engineering workstations running TIA Portal or STEP 7 should be mapped against their corresponding PLCs in the asset inventory. Connections from unapproved terminals, writes occurring outside change windows, or configuration changes without accompanying work orders should not be dismissed as routine maintenance traffic.
In sites where third-party maintenance companies or system integrators connect remotely, asset owners may not even be aware that a PLC is exposed to the internet. Pathways must be verified all the way through to contractor circuits and gateways, since unauthorized reads may represent environmental reconnaissance in preparation for future write operations.
An OT guidance document published by CISA and others in May 2025 also noted that OT equipment connected to the public internet is easily discoverable through port scanning, and that authentication and authorization mechanisms often cannot withstand modern threats. The entry point here is the same exposure pathway. Alongside planning for patch deployment, confirming whether PLCs have actually been disconnected from the internet is the most direct response to the conditions currently disclosed.