U.S. cybersecurity agencies, including CISA, the FBI, and the NSA, are warning that hackers — suspected to be linked to Iran — are using AI to identify and exploit vulnerable Siemens S7 programmable logic controllers (PLCs) that run American water and wastewater systems. Incidents have now hit utilities in at least five states: Minnesota, Michigan, Arkansas, Georgia, and New Jersey.
Investigators say the attackers use AI models to generate exploit scripts and quickly understand how these internet-connected industrial controllers work, then remotely change administrator passwords to disrupt operations. Consequences have included flooding and pressure loss that could let untreated groundwater seep into pipes. Rural utilities, which cover wide service areas with thin IT staffing, have been especially exposed.
CISA has repeatedly urged infrastructure operators to take these controllers off the public internet, but many rural systems remain connected. The wave of attacks shows how AI is lowering the technical bar for compromising critical infrastructure that has long relied on obscurity rather than robust security.