U.S. Warns Hackers Are Using AI to Target Water Systems

U.S. cybersecurity agencies warn that hackers are using AI-generated exploit scripts to target vulnerable industrial controllers in water systems and other critical infrastructure.

In a joint cybersecurity advisory, CISA, the FBI, NSA and other agencies warned about attacks targeting Siemens S7 programmable logic controllers, or PLCs. These devices help control automated physical processes across water and wastewater systems, energy, manufacturing and agriculture.

AI is helping attackers find vulnerable systems

According to the agencies, attackers are using AI to generate scripts based on publicly available information and to identify PLCs running outdated software or exposed due to weak security. Successful attacks could cause operational downtime, equipment damage or safety problems.

The warning reinforces longstanding advice to keep industrial control systems isolated from the public internet and maintain updated security protections. Smaller and rural water utilities can be particularly vulnerable because they often operate across large areas with limited cybersecurity resources.

AI does not necessarily introduce new underlying vulnerabilities. Many industrial systems were already exposed due to outdated software, internet-facing equipment, or weak passwords. The concern is that AI can make it easier for attackers to understand those systems and automate parts of the exploitation process.

Water utilities have faced a series of attacks

The advisory follows heightened concern about cyberattacks on U.S. water infrastructure. The New York Times reported on suspected Iranian-linked activity targeting water systems, while security experts have described some utilities as particularly attractive targets due to weak defences. The Washington Post reported similar concerns following recent intrusions.

Incidents have also been reported in several states. A Michigan water system disclosed a cyberattack, while a Georgia utility reported an intrusion that authorities were investigating for possible links to Iran.

Federal officials have also responded to attacks involving water utilities in New Jersey. The incidents add urgency to the latest warning as attackers increasingly combine readily available information, exposed industrial equipment and AI-assisted tools to target essential infrastructure.