# NSA Warning: AI-Generated Cyberattacks Are Already Hitting Infrastructure > Source: > Published: 2026-08-24 00:00:00+00:00 # NSA Warning: AI-Generated Cyberattacks Are Already Hitting Infrastructure NSA, FBI, CISA, DOE and EPA warn AI-generated exploits are actively probing power and water infrastructure. Here's what the advisory actually says. ## What did the NSA and FBI actually warn about? A joint advisory from the NSA, FBI, CISA, the Department of Energy, and the EPA states that threat actors are using AI to generate Python-based exploitation scripts built on open-source libraries, and are aiming them at energy and water infrastructure. The agencies called it explicitly “not a theoretical risk” but “an active threat.” Their statement says this represents an evolution in attacker capability that dramatically cuts the technical skill and time needed to run a cyberattack. The advisory specifically flagged internet-exposed Siemens S7 programmable logic controllers (PLCs), industrial computers widely used to automate manufacturing lines, power plants, and water treatment systems. ## TL;DR - A joint US advisory from **NSA, FBI, CISA, DOE, and EPA** says AI-generated exploitation scripts are actively targeting energy and water infrastructure, not just theoretically threatening it. - The agencies flagged **internet-exposed Siemens S7 PLCs**, industrial controllers used across power, water, and manufacturing systems, as a specific point of exposure. - The advisory describes attacker behavior as **persistent reconnaissance**, meaning automated tools are continuously scanning code and exposed systems for vulnerabilities rather than launching one-off attacks. - A separate, unconfirmed report claims **Iranian-linked hackers knocked out a UK power plant for four days**, though officials have not publicly tied that specific incident to AI tooling. - The core shift the agencies describe is scale: AI lets a much smaller pool of people run **continuous, cloneable scanning** that once required scarce, highly paid security expertise. - This warning lands alongside a wave of new frontier model releases, following **Anthropic’s decision to restrict a model over dangerous capability concerns**, a marker several in the AI safety community treat as a turning point. - The practical takeaway for builders and infrastructure operators is the same one security teams have pushed for years, now with more urgency: **patch exposed industrial systems and assume automated scanning is constant**, not occasional. ## Remy doesn't write the code. It manages the agents who do. Remy runs the project. The specialists do the work. You work with the PM, not the implementers. ## Why does AI change the threat model for infrastructure? Historically, finding a working exploit against an industrial control system required someone with real cybersecurity depth: knowledge of the target hardware, the patience to read through code, and the skill to chain a vulnerability into something usable. That combination of skills is rare and well compensated, which naturally limited how many people were doing this work and how fast they could do it. AI changes the economics, not the ceiling. A capable model can generate exploitation scripts against known vulnerability classes, search code for weaknesses, and do it continuously, at low cost, without sleeping. The agencies’ language captures this directly: the risk isn’t a smarter attack, it’s a much larger number of attempts run in parallel by tools that don’t get tired or expensive. Multiply that by however many instances of a model someone wants to run at once, and the reconnaissance surface grows in a way that human teams alone could never sustain. That’s also the reasoning behind the “persistent reconnaissance” framing in the advisory. The agencies aren’t describing a specific breach event. They’re describing automated systems continuously probing every exposed codebase and device they can reach, looking for an opening. Security researchers doing legitimate vulnerability disclosure are reportedly finding similar volumes of flaws in the same systems, which suggests the exposure is real and widespread, independent of who’s exploiting it. ## Is there a confirmed link between AI and the UK power plant attack? Not officially, as of the reporting available. A story broke around the same time as the advisory describing an incident in which hackers, reportedly linked to Iran, shut down a UK power plant for four days, described as one of the more serious cyberattacks against UK infrastructure to date. Nothing in that reporting explicitly ties the incident to AI-generated tooling. The NSA and FBI, for their part, are also not claiming certainty about attribution in their own advisory. What connects the two stories is circumstantial: the advisory confirms AI-assisted exploitation is being used against this exact category of infrastructure, at the exact moment a major infrastructure attack is making headlines. Whether that specific event involved AI tooling or not, the advisory establishes that this kind of attack is now a documented category, not speculation. ## Why is this surfacing now, alongside new frontier model releases? The timing lines up with a period of rapid frontier model turnover. Multiple labs are reportedly working on next-generation systems, with heavy investment specifically in coding and agentic capability, the same capabilities that make a model useful for finding and exploiting software vulnerabilities. One major lab reportedly declined to release a model at all, citing danger, a moment some in the field treat as the first time a frontier lab explicitly drew that line rather than just talking about safety in the abstract. ## Seven tools to build an app. Or just Remy. Editor, preview, AI agents, deploy — all in one tab. Nothing to install. The connection to infrastructure security is direct rather than coincidental. Models optimized for autonomous coding and multi-step reasoning are, by construction, also good at the kind of methodical, exhaustive code review that vulnerability research requires. Improving a model’s ability to write and debug software autonomously improves its ability to find flaws in software it’s given access to. Labs aren’t necessarily building “hacking models,” but general capability gains in coding and agentic reasoning carry over into offensive security use whether or not that was the goal. ## What should infrastructure operators and builders actually do? The advisory’s practical message is closer to a patch reminder than a call to panic: internet-exposed industrial control systems, specifically named devices like Siemens S7 PLCs, need to be inventoried, patched, and where possible taken off direct internet exposure. That guidance predates AI. What’s changed is the volume and persistence of scanning against those systems, which raises the cost of leaving known gaps unaddressed. For teams building with AI rather than defending infrastructure, the relevant lesson is about dual-use capability. The same agentic coding skills that make a model valuable for automating software development make it valuable for automated vulnerability discovery. Anyone deploying agents with broad code execution or network access should treat that access with the same caution security teams apply to human contractors: least privilege, logging, and monitoring for reconnaissance-like behavior, not just for outright attacks. ## Frequently Asked Questions ### What agencies issued this warning? The advisory was issued jointly by the NSA, FBI, CISA, the Department of Energy, and the EPA, covering AI-generated cyberattack tools targeting critical infrastructure. ### What specific systems are at risk? The advisory names internet-exposed Siemens S7 programmable logic controllers as a point of concern. These are industrial computers used to automate processes in power plants, water treatment facilities, and manufacturing operations. ### Does this mean AI caused the UK power plant outage? That hasn’t been confirmed. Reports describe a four-day outage at a UK power plant reportedly linked to Iranian hackers, but officials have not publicly stated that AI-generated tools were used in that specific incident. ### How is AI actually being used in these attacks, according to the advisory? The agencies describe attackers using AI to generate Python exploitation scripts built on open-source libraries, and characterize the broader pattern as persistent, automated reconnaissance scanning exposed systems for vulnerabilities. ### Is this specific to one country’s infrastructure? The advisory centers on US energy and water infrastructure, but the underlying industrial hardware named, like Siemens S7 PLCs, is used globally, meaning the exposure isn’t limited to any single country’s systems.