Five United States federal agencies warned on Wednesday that attackers are using AI‑generated scripts to compromise internet‑exposed Siemens S7 Series programmable logic controllers in water, manufacturing, energy and other critical facilities. The advisory, issued by the NSA, CISA, FBI, Department of Energy and EPA, did not name a specific perpetrator but said evidence points to Iranian cyber operatives targeting PLCs at water and wastewater facilities in at least 12 states, including an incident that disrupted more than 30 community water systems in Minnesota in late July. Attackers combine the open‑source snap7.dll/python‑snap7 libraries with AI coding assistants to produce custom tools that emulate operational technology monitoring software. These tools provide read/write access to PLC memory, configuration data and ladder logic programs over the S7comm protocol. The agencies said the AI assistance enables creation of exploitation scripts using publicly available information about the PLCs, supporting initial access, credential theft, denial‑of‑service and other objectives. They noted that exposure of PLCs to the internet or lack of network segmentation can allow exploitation of known high‑severity vulnerabilities. Cynthia Kaiser, senior vice president of research at the Halcyon Ransomware Research Center and former deputy assistant director of the FBI cyber division, said the advisory reflects the expectation that state‑sponsored actors are using AI to automate discrete tasks and increase operational speed. Benny Czarny, chief executive and founder of Opswat, added that AI lowers the technical barrier for attacking industrial control systems by simplifying script development, though he emphasized that the primary concern remains insufficient OT network defenses. The advisory recommends immediate inventory of all Siemens S7 Series PLCs, application of security patches, removal of internet accessibility, and monitoring for anomalous S7comm activity such as connections from non‑engineering workstations or unusual data block access. Reducing the OT attack surface may include using data diodes to ensure one‑way data flow, the agencies said. The agencies warned that continued exploitation of these PLCs could affect essential services, and they urged operators to implement the recommended safeguards while the investigation proceeds.