By Thorsten Meyer | October 24, 2026 | ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
Since mid-August, US agencies warned that attackers use AI-written scripts against industrial controllers, Microsoft tied an agentic AI framework to a supply-chain compromise that reached Microsoft 365 tenants, and OpenAI said AI-found critical vulnerabilities will “increase sharply in the coming months.” Here is what the primary sources confirm, what is a forecast, and the short list of basics that companies and users should act on now.
Key takeaways
- AI is now in the attacker’s toolchain, on the record. A joint advisory from NSA, CISA, FBI, DOE and EPA says actors use AI-generated exploitation scripts against Siemens S7 controllers in US critical infrastructure. Microsoft says the China-state aligned actor Storm-0940 used the open-source agentic framework ARTEX against hundreds of organizations, in several cases reaching privileged cloud access in under three hours.
- The real change is economics, not genius. Microsoft says agents “can work around the clock.” Palo Alto Networks’ Unit 42 watched one do “hundreds of hours of manual targeting analysis in mere minutes.” Most attempts still failed. What has gone is the attacker’s time limit.
- The defender side is accelerating too. OpenAI says AI found the critical PHP flaws patched on October 21 before attackers did, and expects similar findings to rise sharply. More fixes, faster, means more patching pressure on everyone.
- Forecast, labelled as such: a security leader whose view reached me this week expects things to get worse before they get better, a “vulnerability tsunami” within months, and roughly 18 months to hold on. That is an expert opinion, not a measurement.
- What to do: companies should ask their boards for the basics, not for AI: inventory, patch deadlines, phishing-resistant sign-in, third-party app reviews, isolated OT networks and practised incident response. Users should start with their email account.
Products Worth Considering
LG UltraGear 27-inch QHD OLED Gaming Monitor, 240Hz
Bose TV Speaker – Compact Soundbar with Bluetooth and HDMI-ARC, Includes Remote, Black
Logitech MX Master 4 for Mac, Ergonomic Bluetooth Mouse with Haptic Feedback, Ultra-Fast Scrolling, USB-C Charging, for MacOS, iPadOS, Windo
As an affiliate, we earn on qualifying purchases.
Why this week feels different
Two days ago I covered the pile-up of patches in 72 Hours of Security Headlines. This piece is about something else: documented cases where AI itself does the attack work, and what that changes for defenders.
The pattern is not an AI super-hacker. It is ordinary attack steps, such as scanning, password spraying, abusing a trusted app or adapting a public exploit, done by software that never gets tired.
Case 1: AI-written scripts against industrial controllers
The joint Cybersecurity Advisory published on August 18 is unusually blunt: “This is not a theoretical risk—it is an active threat.” The authoring agencies say actors are doing reconnaissance and capability development against US installations of Siemens S7 programmable logic controllers, the small industrial computers that run pumps, valves and production lines. The named models run from the S7-200 to the S7-1500, safety controllers included.
According to the advisory, the actors find exposed PLCs through internet scanning services, then use “AI-generated exploitation scripts disguised as legitimate monitoring tools,” built on the open-source snap7 library. The agencies call this “an evolution in threat actor capabilities, dramatically reducing the technical expertise and time required.” Most targeted: manufacturing, energy, water, chemical, food and agriculture, and commercial facilities. The agencies assess the activity as likely preparation “to cause operational effects against critical infrastructure.”
What the advisory recommends is basic, and that is the point: inventory every controller, patch firmware, make sure PLCs are not reachable from the internet, block TCP port 102 at the perimeter, separate IT and OT with a DMZ, deploy “unidirectional gateways for data historian connections where appropriate,” require multi-factor authentication for all remote access to OT, and monitor S7 traffic for writes outside change windows.
Case 2: an AI agent rides a trusted supply chain
On October 21, Microsoft Threat Intelligence described how Storm-0940, which it calls a China-state aligned actor active since 2021, used ARTEX, an open-source multi-agent penetration testing framework that can run “from reconnaissance through data exfiltration with little needed human interaction.” Microsoft assesses that Storm-0940 was behind the ConnectWise Cloud Backup compromise, which ConnectWise first disclosed on October 16.
The numbers in Microsoft’s report show what machine speed looks like:
- After obtaining the cloud backup app’s credentials, the actor used ARTEX to try to sign in to more than 2,250 tenants, using trust that customers had already granted to the app.
- In a password-spray campaign between October 10 and 14, Microsoft logged more than 151,000 failed logons, peaking at 2,900 failures per minute. None of them succeeded.
- In several attacks, the time from initial targeting to privileged cloud access was under three hours.
Microsoft adds two caveats that belong in every headline: “the majority of the targeting wasn’t successful,” and an affected app or a successful sign-in “does not necessarily indicate” that data was accessed. ConnectWise says existing backup archives show no indication of compromise. It suspended Cloud Backup, SaaS Security and Cloud Management while it investigated.
Infographic 01 · The record so far
AI is in the attacker’s toolchain. On the record.
Six documented events in twelve weeks. Each label says what the source itself states about AI. Figures are the vendors’ and agencies’ own.
- 30 Jul 2026Unit 42: AI on attackDeepSeek inside the Hermes Agent framework picks and switches targets on its own. Limited impact: across autonomous and manual attempts, data theft from 3 NetScaler systems confirmed. Single-vendor report.
- 18 Aug 2026NSA, CISA, FBI, DOE, EPA: AI on attackAI-generated exploitation scripts, disguised as monitoring tools, against Siemens S7 PLCs in US critical infrastructure. “Not a theoretical risk.”
- 10–14 OctStorm-0940 password spray: AI on attack151,000+ failed logons across eight organizations. No successful sign-in. Lockouts made up nearly 98% of responses.
- 16–21 OctConnectWise Cloud Backup: AI on attackStolen app credentials, then machine-speed sign-ins to customer tenants. Microsoft attributes it to the China-state aligned Storm-0940.
- 21 Oct 2026OpenAI, Patch the Planet: AI on defenceAI found the critical PHP flaws before attackers did. OpenAI expects similar findings to “increase sharply in the coming months.”
- 21–22 OctQuest Diagnostics: no AI link reportedUnauthorized access to a lab ordering and results system; certain patient records accessed. No cause or attacker named.
Most AI-driven attempts in these reports failed. What changed is the cost of trying.Assessment: Thorsten Meyer
Sources: Unit 42 (30 Jul 2026); NSA, CISA, FBI, DOE, EPA advisory (18 Aug 2026); Microsoft Threat Intelligence (21 Oct 2026); ConnectWise Trust Center (from 16 Oct 2026); OpenAI, Patch the Planet (21 Oct 2026); Quest Diagnostics Form 8-K (22 Oct 2026).
Powered by Thorsten Meyer AI
Case 3: the agent that chose its own target
Unit 42’s July 30 report documents a Chinese-speaking actor who wired the DeepSeek model into the Hermes Agent framework and steered it over Telegram. When its first exploit failed, the agent searched GitHub for trending proofs of concept, surveyed ten product families and switched to more promising targets on its own. Unit 42 calls it “a functional, end-to-end autonomous offensive capability,” while noting the campaign had limited impact: across autonomous and manual attempts, it confirmed data theft from three Citrix NetScaler systems and command execution on 11 notebook servers. That is a single-vendor report, but a detailed one.
Case 4: the breach that shows the stakes
Not every incident this week involves AI, and honesty requires saying so. Quest Diagnostics told the SEC in an 8-K filing that on October 21 it learned of unauthorized access to its Quanum Lab Services Manager, which some clients use to order tests and look up results, and that it believes “an unauthorized party accessed certain patient records.” The Houston Chronicle reports that Quest paused access to the system and that core operations kept running. Quest has not named a cause or an attacker, and nothing public links the breach to AI. I include it because it shows what sits at the end of these attack chains: client portals, third-party access and very personal data.
The turn: the attacker’s clock is gone
For decades, defenders had an unspoken ally: attacker time. Exploits took skill, targets took hours to research, and human operators slept. The PLC advisory is about lower expertise and time, Storm-0940 about volume and speed, Unit 42’s agent about choosing what to try next.
The same capability works for defenders. In its Patch the Planet update, OpenAI says the critical PHP flaws were found by the research firm Calif using GPT-5.6 Sol, and independently by Wiz, and that “frontier AI found these vulnerabilities before attackers did.” It also writes that it expects “similar findings to increase sharply in the coming months,” and that time to prepare fixes “may be in short supply.” Tools like Anthropic’s formal verification work help in the long run. In the short run, more bugs found means more patches to ship, and every patch tells attackers where to look.
That is the context for the forecast I mentioned at the top. The security leader’s view, in short: use this crisis, go to your board now, and ask for the basics rather than for AI; expect a “vulnerability tsunami” within months, with too little time to patch critical infrastructure; isolate OT networks now, with air gaps and data diodes. I share the direction. The 18 months and the size of the wave are a forecast. The sources above confirm the direction, not the timeline.
What this means for companies
This section is my assessment, built on the sources’ recommendations.
- Ask the board for basics, with deadlines. A complete asset inventory, including OT devices and every third-party app with access to your tenant. Patch deadlines by exposure: internet-facing first, measured in days, not quarters. The NSA advisory’s first step is literally “conduct an immediate inventory.”
- Make sign-in phishing-resistant. Passkeys or hardware keys for administrators and remote access first. The PLC advisory calls for MFA on all remote access to OT. Storm-0940’s password spray ran at up to 2,900 attempts per minute; account lockouts are what stopped it.
- Audit what you have already trusted. Storm-0940 did not break Microsoft; it used app permissions that customers had granted. Review multi-tenant apps, consent grants and service-principal sign-ins, as Microsoft recommends, and cut privileges to the minimum.
- Isolate OT now. The advisory supports: no internet exposure, block port 102, a DMZ between IT and OT, and unidirectional gateways, often called data diodes, for historian data. Full air gaps go beyond what the advisory asks and suit the most critical systems. Treat that as a design decision, not a slogan.
- Practise for machine speed. If an attacker can move from first contact to admin in under three hours, your response plan cannot start with a meeting next morning. Drill it: who can disable an app, rotate keys and isolate a segment at 2 a.m.?
Infographic 02 · The isolation ladder
Keep the controllers off the Internet. Then go further.
What the NSA-led advisory on Siemens S7 PLCs asks owners to do, in order, and where an expert’s call for full air gaps goes beyond it.
Isolate, step by step
From most basic to strongest
- Inventory advisory
every PLC, its firmware, and every engineering workstation with programming access - Patch advisory
PLC firmware and the engineering software; Internet-facing and DMZ controllers first - No Internet exposure advisory
block TCP port 102 at the perimeter; audit firewall rules for S7comm - Separate IT and OT advisory
a DMZ between the two; no unauthorized routing from the office network - One-way data advisory
unidirectional gateways (data diodes) for historian connections, where appropriate - Lock access advisory
MFA for all remote access to OT; PLC passwords and write protection - Full air gap beyond the advisory
for the most critical systems: an expert recommendation, not in the advisory
Hunt for these signs
detection from the advisory
- S7comm connections from machines that are not engineering workstations
- Write operations outside change windows or without a work order
- Sequential scanning of port 102 and repeated connection attempts
- snap7 library or Python S7 scripts outside approved workstations
- Off-hours activity that looks like automated scripting, not people
Owners who rely on integrators or managed service providers should share the advisory with them and ask for the same steps.
Source: NSA, CISA, FBI, DOE, EPA advisory (18 Aug 2026), mitigation and detection sections. The air-gap step reflects an expert view shared with the author.
Powered by Thorsten Meyer AI
What this means for users
Automated attacks reach private accounts too, and breaches like Quest’s put personal data into circulation. My recommendations, in order:
- Secure your email first. It resets everything else. Add a passkey or a hardware security key.
- Use an authenticator app instead of SMS codes wherever a service offers it.
- Use a password manager with unique, random passwords and turn on its breach alerts.
- Freeze your credit at Equifax, Experian and TransUnion if you live in the US. It is free and can be lifted when you need it.
- Delete dormant accounts. Each one is an unmonitored door.
- Treat urgent messages as hostile. If an email or text demands fast action, do not click. Go to the source by typing the address yourself or calling a number you already know.
Infographic 03 · The basics, now
Six things for the board. Six things for you.
None of this is new. All of it matters more when attackers no longer run out of time.
For companies: the board ask
basics, with deadlines
- Inventory every asset, including OT devices and third-party apps with tenant access
- Patch deadlines by exposure: Internet-facing in days, not quarters
- Phishing-resistant sign-in: passkeys or hardware keys for admins and remote access
- Audit trusted apps: consent grants, service-principal sign-ins, least privilege
- Isolate OT: no Internet exposure, DMZ, one-way gateways
- Drill at machine speed: who can disable an app and rotate keys at 2 a.m.?
For users: start with email
in this order
- Email first: add a passkey or a hardware security key
- Authenticator app instead of SMS codes
- Password manager: unique random passwords, breach alerts on
- Credit freeze at Equifax, Experian and TransUnion (US): free, can be lifted
- Delete dormant accounts you no longer use
- Urgent means hostile: do not click; go to the source yourself
Ask the board for the basics, not for AI.The “roughly 18 months” horizon is an expert forecast, not a measurement.
Recommendations: Thorsten Meyer, building on NSA, CISA, FBI, DOE, EPA advisory (18 Aug 2026) and Microsoft Threat Intelligence (21 Oct 2026).
Powered by Thorsten Meyer AI
Honest limits
- Confirmed by primary sources: the AI use described in the NSA-led advisory, Microsoft’s Storm-0940 report and Unit 42’s report; the ConnectWise suspension; Quest’s 8-K; OpenAI’s statements on PHP and its expectation of more findings.
- Not confirmed: any AI link in the Quest breach, the 18-month horizon and the size of the coming wave. Several figures circulating on social media this week, such as monthly ransomware growth rates or specific DDoS records, I could not trace to a primary source, so I left them out.
- Attribution is the vendors’ own. “China-state aligned” is Microsoft’s assessment; ConnectWise cites it.
Verdict
It is worse than we thought in one specific way: the cost of trying has collapsed. Most AI-driven attempts in these reports still failed against basic controls, and that is the hopeful part. The organizations that will get through the next year and a half are not the ones buying the most AI security tools. They are the ones that know what they own, patch it fast, lock down sign-ins and keep the controllers off the internet. Go to the board this month, and ask for exactly that.
Sources
- NSA, CISA, FBI, DOE and EPA: Joint Cybersecurity Advisory, Defending Against an Active Threat to Siemens S7 Series PLCs (August 18, 2026)
- Microsoft Threat Intelligence: Storm-0940 uses ARTEX agentic AI in ConnectWise supply chain compromise (October 21, 2026)
- ConnectWise: Trust Center advisories, Cloud Backup service interruption (first posted October 16, 2026; accessed October 24)
- Palo Alto Networks Unit 42: Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks (July 30, 2026; single-vendor report)
- OpenAI: Patch the Planet: global response coordination as agents uncover critical vulnerabilities (October 21, 2026)
- Quest Diagnostics: Form 8-K (filed October 22, 2026)
- Houston Chronicle: Medical lab Quest Diagnostics cyber breach may affect patient records (October 23, 2026)
