AI-Generated Scripts Target Siemens S7 PLCs: CISA AA26-231A Alert

Detail

required rare, expensive, protocol-level expertise. That moat has been drained. Joint advisory AA26-231A, issued on 19 August 2026 by CISA, the NSA, the FBI, the Department of Energy and the EPA, documents threat actors using AI-generated Python scripts to enumerate and interact with internet-exposed S7 controllers , and follow-up analysis published on 29 August frames it as an inflection point for the entire operational technology (OT) threat landscape.

The advisory is not a product recall. It is a verdict on how the world deploys automation hardware.

The newsworthy element in AA26-231A is not a CVE. It is a labour-cost story. Generative AI has converted PLC exploitation from a specialist craft into a scripted commodity, and commodity attacks scale in ways specialist attacks never did.

The five-agency advisory describes threat actors leveraging internet scanning services such as Censys and ZoomEye to locate S7 controllers running outdated firmware, weak credentials or insufficient segmentation. The tooling itself is unremarkable Python , and that is precisely the point.

inside utilities disguised as benign monitoring software. Through the S7comm protocol on TCP port 102, those scripts can read and write data blocks, configuration data and control logic.

AI-generated Python built on snap7 / python-snap7, presented as monitoring utilities

Critical manufacturing, energy, water and wastewater, chemical, food and agriculture, commercial facilities