The advisory’s headline finding is not the vulnerability, it is who is writing the exploit code now.
AI as the exploit developer, not just the target
On 19 August, CISA, the NSA, the FBI, the Department of Energy and the EPA published a joint advisory confirming ongoing attacks against internet-exposed Siemens S7 Series programmable logic controllers, spanning the S7-200, S7-300, S7-400, S7-1200 and S7-1500 lines, including F-series safety controllers. What makes this advisory different from the usual industrial control system bulletin is the method: attackers are using AI code generation to produce Python scripts, built on the python-snap7 library, that connect to a target over the S7comm protocol, read its data blocks to understand what physical process it is controlling, and can then write modified values or ladder logic back to the device. This is the first time a government advisory has confirmed AI-generated code being used operationally against industrial controllers rather than just discussed as a future risk.
Finding targets takes minutes, not expertise
Attackers locate targets using internet scanning services such as Censys and ZoomEye to enumerate PLCs with port 102, the S7comm port, exposed to the public internet and running outdated or poorly protected firmware. Historically, turning a scan result into a working attack against a specific PLC model required real familiarity with industrial protocols, a skill set that limited how many people could act on exposed devices even after finding them. AI code generation removes that bottleneck: the advisory describes attackers using publicly available technical documentation to have AI produce working exploitation scripts, which is exactly the kind of task large language models are good at when the underlying protocol details are already public.
A German-made controller is not just a US problem
Siemens is a German company, and S7 Series PLCs are deployed across European water treatment, energy, manufacturing and food and agriculture facilities at least as widely as in the US. The advisory names Critical Manufacturing, Energy, Water and Wastewater Systems, Chemical, Food and Agriculture, and Commercial Facilities as the most-targeted sectors, and notes S7 PLCs also serve defence contractors, an unambiguous European exposure given the continent’s own defence-sector manufacturing base. Exploitation of a poorly protected PLC is not an abstract compliance line item, it can mean disrupted industrial processes, safety incidents, equipment damage, and cascading failures across whatever depends on that process running normally. Under NIS2, operators in these sectors are already expected to be able to show they know what is internet-facing in their OT environment. This advisory is a direct test of whether that is actually true.
What operational technology teams should do now
Get an accurate inventory of which PLCs and other OT devices are reachable from the public internet, not which ones you believe are air-gapped. Confirm port 102 and other S7comm-related ports are not exposed beyond a tightly controlled network segment, and if remote access to a PLC is genuinely required, it should go through a monitored, authenticated gateway rather than a direct connection. Treat “our OT network is separate from IT” as a claim to verify, not a fact to assume, since these attacks specifically target devices someone assumed were not reachable.
If your organisation needs an OT exposure assessment, help segmenting industrial systems from the public internet, or a NIS2-aligned review of your critical infrastructure security posture, contact Excello Digital. We help European operators find out what is actually exposed before an AI-assisted attacker does.