AI Governance Institute
← News
Research2026-08-26

Exploited MLflow SSRF and AI-Generated PLC Attacks Converge on AI Infrastructure

Source

CISO Daily Briefing, 2026-08-23

Cloud Security Alliance

What happened

The CISO Daily Briefing, 2026-08-23 published by the Cloud Security Alliance on August 23 identified two distinct but converging AI security threats. The first is a critical SSRF vulnerability in MLflow, an open-source platform widely used by enterprise teams to track experiments, manage model versions, and serve AI models, that is being actively exploited in the wild to harvest cloud credentials from the environments where AI systems are built and run. The second finding follows a joint government advisory warning that threat actors are using AI-generated Python exploit scripts to target Siemens S7 programmable logic controllers, the devices that govern physical processes in manufacturing, energy, and utilities, lowering the skill barrier for industrial control system attacks. This briefing follows Five Agencies Warn AI Is Lowering the Bar for ICS Attacks on Critical Infrastructure, a prior advisory covering similar ICS threat patterns, and arrives shortly after CVE-2025-9141 Makes Inference Engines a Governed Security Dependency, which established that AI serving infrastructure now carries material security obligations. Both findings underscore that AI governance programs must extend security controls to the pipeline tooling layer, not just to model outputs.

Why it matters

  • ·MLflow is embedded in AI development workflows across a wide range of industries, meaning the SSRF vulnerability converts AI pipeline tooling into a credential exfiltration vector. Compliance teams that treat AI infrastructure as separate from enterprise security controls now face a documented, actively exploited gap in their attack surface.
  • ·The AI-generated PLC exploit advisory significantly expands the risk perimeter for organizations operating or supplying critical infrastructure. Industrial control system attacks previously required specialized expertise; AI-generated tooling removes that barrier, elevating the threat model for OT environments and triggering obligations under critical infrastructure risk frameworks that compliance teams may not have previously applied to AI-adjacent threats.
  • ·Together, these findings expose a structural gap in most enterprise AI governance programs: controls focus on model behavior and regulatory compliance but do not extend to the security posture of the infrastructure used to develop, track, and serve models. The OWASP Top 10 for Large Language Model Applications flags supply chain and infrastructure risks, but most enterprise programs have not operationalized those controls at the pipeline tooling level.

Governance controls affected

AGT-019AI Tool and Plugin Supply Chain Risk AssessmentSCT-003Critical Infrastructure AI Risk Assessment and ContainmentSEC-003Sensitive Data Handling in AI PipelinesSAF-006Post-Deployment Adversarial Testing CadenceAGT-023Agentic AI Security Assessment, CBRN and Cyber Espionage

What to do now

  • ☐Audit all MLflow deployments for the SSRF vulnerability and apply available patches or mitigations immediately, treating this as an active-exploit incident rather than a scheduled patch cycle.
  • ☐Rotate cloud credentials and API keys accessible from any environment running MLflow, and verify that least-privilege access policies are enforced for all AI pipeline services.
  • ☐Extend your AI system inventory to include model lifecycle tooling such as experiment trackers, model registries, and serving engines, and classify each for security risk exposure.
  • ☐Brief OT/ICS security and compliance teams on the AI-generated PLC exploit advisory and confirm that Siemens S7 devices and adjacent control systems are covered by current patch and monitoring programs.
  • ☐Review your open-source model and AI tooling intake policy to confirm that security patching cadences and vulnerability monitoring cover AI pipeline dependencies, not just the models themselves.

What to watch next

Compliance teams should monitor whether the MLflow SSRF disclosure triggers coordinated guidance from cloud providers or government cybersecurity bodies, as mandatory patch timelines could follow for regulated sectors. The ICS advisory pattern, now appearing across multiple intelligence sources, signals that AI-generated exploit tooling for OT environments is becoming a sustained threat category rather than an isolated incident, and teams should expect follow-on guidance from sector-specific regulators in energy, manufacturing, and defense. Broader AI infrastructure security requirements are also likely to surface in upcoming revisions to AI procurement and vendor risk frameworks, building on the trajectory established by CSA Research Note Sets Security Governance Baseline for Frontier Model Procurement.

Stay ahead of stories like this

Get every US AI governance development like this one, plus the rest of the week's developments. Every Thursday.

Free every Thursday. Unsubscribe anytime.

Related Coverage

Research2026-09-29

AI Gives Lone Attackers Extortion Power That Outpaces Hospital Defenses

Anthropic has documented a single cybercrime ring using Claude Code to extort healthcare organizations, emergency services, and government entities within one month. The most powerful AI-assisted defensive tools are restricted to large enterprises and critical infrastructure operators, leaving hospitals, nonprofits, and municipalities without equivalent protection. This access gap creates a structural compliance and risk management problem for smaller institutions that cannot afford or qualify for gated defensive tools.

Research2026-10-03

Orchestration Framework Flaws Make AI Workflow Pipelines a Primary Attack Target

Research published by Help Net Security finds that agent orchestration frameworks including Flowise and Langflow are among the most actively targeted systems in current vulnerability disclosures. Attackers use prompt injection and manipulated workflow configuration files to reach code execution points inside enterprise AI pipelines. Organizations running agentic workflows need isolation, configuration validation, and red-team coverage at the orchestration layer, not just at the model level.

Research2026-09-25

Three Attacks Target AI Keys, LLM APIs, and Provider Access Controls

Security researchers have documented three distinct active threats targeting AI infrastructure: credential-harvesting malware hidden in AI agent packages, a Windows implant that delegates command-and-control decisions to commercial large language models including DeepSeek and Gemini, and nearly 11,000 relay servers routing sanctioned-region traffic to Anthropic, OpenAI, and Google. Each threat exploits a different gap in how enterprises govern their AI dependencies, API credentials, and provider-level access controls. Compliance teams cannot rely on provider-side controls alone to contain any of these risks.