Zero: the number of new S7 flaws in the AI exploit-script alert

The figure is zero: Wednesday's joint advisory from the NSA, CISA, FBI, Energy Department and EPA describes no new vulnerability in Siemens S7 Series programmable logic controllers, according to Siemens, which said the alert instead "reflects threat actors employing new techniques to exploit potential misconfigurations" ^[1][3]. Siemens added that it has "not identified increased attack levels or unknown vulnerabilities in Siemens ICS products" ^[4].

That zero is the whole operational point. With no defect to patch, the exposure described in the advisory is one operators created themselves: the actors use internet scanning services to find internet-exposed PLCs running outdated software or that are otherwise poorly protected, then run AI-generated scripts disguised as legitimate monitoring tools ^[7][8]. The agencies' claim about AI is about labour, not about a new hole. Generating exploitation scripts with AI "dramatically reduc[es] the technical expertise and time required to develop working ICS exploitation scripts and malicious tools," the alert says ^[6]. Cheaper attacker time against unchanged, reachable devices.

The agencies called this an active threat rather than a theoretical one, spanning water, food, energy, chemical, manufacturing and commercial facilities, with possible consequences including disrupted processes, safety incidents, downtime, equipment damage, data compromise, compliance violations and cascading effects across interconnected systems ^[1][2][11]. It is not the first warning: CISA flagged a significant increase in PLC targeting on July 30, after a July 22 advisory on Iranian-affiliated actors exploiting Siemens, Rockwell Automation and Schneider Electric devices ^[12]. That advisory attributed disruptions to manipulation of PLC project files and of data shown on HMI and SCADA displays, with operational disruption and financial loss in a few cases ^[13]. Wednesday's alert does not mention Iran ^[14].

Michael Garcia, a former senior CISA official now at Monument Policy Advocacy, said on LinkedIn it is the first CISA advisory he has seen asserting that a malicious actor is using AI scripts against OT, and noted the mitigations are traditional ones ^[9]. Brian Proctor, CEO of OT testing firm Frenos, said the exposure pattern is not brand specific: an adversary who has mapped your data blocks knows what an operator would fail to notice ^[10].

What would move the number: Siemens says updates will come through its ProductCERT team, so a ProductCERT finding of an actual S7 vulnerability, or of raised attack levels, would turn this from a configuration problem into a patch cycle ^[5].