AI finds decades-old vulnerabilities while letting attackers reach previously obscure industrial control systems

The premise of security through obscurity was that age, complexity, or proprietary design would deter attackers long enough for defenders to stay ahead. That premise breaks down once AI can read a codebase, learn a protocol, and propose attack paths faster than any human specialist. The Register cites FBI Cyber Division assistant director Brett Leatherman describing models that broke libraries 'run in 80 percent of web servers' which the community had stress-tested for a decade and assumed secure. The economic asymmetry matters as much as the technical one: a single researcher with a capable model can now surface bugs that previously required sustained community effort.

On the offensive side, the same capability compresses the time between patch release and in-the-wild exploit from days or weeks to hours. The Register describes at least four espionage crews, most with suspected links to China, building an exploit kit for Chromium in the narrow window between upstream patch and downstream stable release. Patch-gap exploitation of that kind is no longer the exclusive province of well-resourced nation-state teams. AI agents also lower the floor of expertise needed to attack systems that were previously gated by specialist knowledge, which is the angle that worries people running critical infrastructure most.

The OT and ICS angle is the most concrete operational change for engineers running critical infrastructure. Former US National Cyber Director Chris Inglis and Google Threat Intelligence Group chief analyst John Hultquist both raised industrial control systems as a worry at Black Hat, noting that their obscurity had functioned as a de facto control. Five US agencies subsequently warned that attackers used AI-generated exploitation scripts to compromise internet-exposed Siemens S7 Series PLCs at water, manufacturing, and energy facilities. The systems that ensure lights, gas, and drinking water keep flowing are now reachable by attackers who do not need to be OT experts themselves.

For engineers, the practical consequence is that anything assumed safe because no one was looking at it is now fair game. Maintainers of widely deployed open source libraries face a backlog of newly surfaced bugs and a shrinking window to patch before exploitation appears. Network and OT operators should treat obscure protocols and vendor-proprietary firmware as active threat surfaces rather than inert legacy. The cost of the change is auditing work that was previously deferred or assumed unnecessary, executed on timelines dictated by how fast an agent can produce an exploit rather than how fast a human team can find one.