What happened

The NSA, CISA, FBI, Department of Energy and EPA issued joint advisory AA26-231A on 19 August 2026, warning of an active threat campaign using AI-generated exploitation scripts — disguised as legitimate monitoring tools — against internet-exposed Siemens S7-series programmable logic controllers running outdated software. The agencies said attackers used internet-scanning services to locate vulnerable, internet-facing PLCs before deploying the AI-written scripts, and characterised the threat as active rather than theoretical, with the potential to disrupt industrial processes, trigger safety incidents or expose sensitive operational data. Affected sectors named in the advisory include water, food, energy, chemical, manufacturing and commercial facilities. The advisory is distinct from, but related to, the CyberAv3ngers/Iran-affiliated PLC campaign documented in AA26-097A (7 April–22 July 2026): that campaign involved actors abusing vendor configuration software (Rockwell Studio 5000, Schneider EcoStruxure, Siemens TIA Portal) to exfiltrate and tamper with project files on Rockwell, Schneider and Siemens equipment, whereas AA26-231A describes a newer AI-assisted scanning-and-exploitation technique specifically against Siemens S7 devices, with no attacker attribution confirmed at the time of this entry. No specific facility, outage or safety incident tied to this AI-assisted campaign had been publicly confirmed when the advisory was issued.

When cited sources give different casualty, damage or spill figures for this event, they’re reported side by side above rather than merged into one number. See how confidence levels work.