US federal agencies warn of active AI-driven infrastructure attacks

Summary

A report jointly published by the NSA, CISA, FBI, DOE, and EPA in September 2026 confirms that artificial intelligence is being actively used to generate exploit scripts targeting Siemens S7 PLCs in U.S. water, energy, waste, and hospital infrastructure. The report characterizes this not as a future risk, but as ongoing campaigns currently in progress.

Why it matters

The report signals a shift from preventive warnings to active incident response. Since large language models (LLMs) can now read manufacturer guidelines and produce working exploit code, the technical barrier to attacking OT systems has collapsed. CrowdStrike data cited in the article shows an 89% year-over-year increase in AI-assisted adversary activity. The fastest lateral movement time has dropped to as little as 27 seconds, far exceeding human incident response capabilities. There is no regulatory framework governing AI models capable of generating industrial control exploits. This highlights a structural governance gap, especially when compared to the heavy certification regimes in nuclear research.

Highlights

• Five federal agencies jointly confirmed active AI-assisted attacks targeting Siemens S7 PLCs controlling water, energy, and hospital systems
• AI-assisted adversary activity increased by 89% year-over-year; the fastest documented lateral movement time is 27 seconds
• There is no regulatory regime for AI models capable of generating OT exploit scripts, unlike regulations for nuclear or hazardous materials research

Critical take

The article’s argument is weakened by marginal notes with weak connections to the main infrastructure security narrative, such as U.S. orbital weapons and Waymo’s city expansion. Additionally, the 27-second lateral movement time is presented without clarifying whether the operation was AI-assisted or merely a fast human operation. This ambiguity weakens the causal link to the AI threat that forms the foundation of the article.