AI-generated code now targeting critical infrastructure controllers

CISA, the FBI and the NSA have issued a joint cybersecurity advisory warning that threat actors are actively using AI-generated code to exploit vulnerabilities in Siemens S7 Series programmable logic controllers (PLCs) deployed across critical infrastructure sectors. The Register reports that the agencies described this as "an active threat" rather than a theoretical risk, with confirmed evidence that adversaries are leveraging large language models to rapidly develop and deploy working exploit code targeting these widely used industrial control systems. The advisory confirms that the threat extends beyond Siemens devices to other PLC manufacturers, and that attackers are specifically focusing on internet-exposed or poorly segmented operational technology environments.

Why this matters for UK organisations

For UK businesses operating industrial control systems, water treatment facilities, manufacturing plants or energy infrastructure, this represents a fundamental shift in the threat landscape. The use of AI to generate functional attack code significantly reduces the technical skill barrier for adversaries and accelerates the timeline from vulnerability disclosure to active exploitation. Many UK critical infrastructure operators still rely on legacy PLCs that were designed without modern security controls, and operational technology networks are often inadequately segmented from corporate IT environments. The advisory makes clear that this is not a future concern but an ongoing campaign targeting real systems in production environments. Organisations that have not yet inventoried their operational technology assets, implemented network segmentation, or established monitoring for industrial control systems are now facing an active and rapidly evolving threat that is specifically designed to exploit these gaps.

What to review

Organisations should verify whether all PLCs and industrial control systems are inventoried, documented and included in asset management processes. IT and operational technology teams should review whether operational technology networks are properly segmented from corporate IT environments, and whether PLCs are directly exposed to the internet or accessible through inadequately secured remote access channels. Security monitoring should be extended to cover operational technology environments, with particular attention to unauthorised access attempts, configuration changes or unusual network traffic patterns. Incident response plans should be reviewed to ensure they account for operational technology environments and that security teams understand the specific risks, constraints and operational impact of industrial control system compromises. Organisations should also consider whether operational technology security responsibilities are clearly assigned and whether there is adequate coordination between IT security, operational technology teams and third-party suppliers who may have remote access to industrial control systems.

Source: The Register