AI Governance Institute
← News
Research2026-08-26

Exploited MLflow SSRF and AI-Generated PLC Attacks Converge on AI Infrastructure

Source

CISO Daily Briefing, 2026-08-23

Cloud Security Alliance

What happened

The CISO Daily Briefing, 2026-08-23 published by the Cloud Security Alliance on August 23 identified two distinct but converging AI security threats. The first is a critical SSRF vulnerability in MLflow, an open-source platform widely used by enterprise teams to track experiments, manage model versions, and serve AI models, that is being actively exploited in the wild to harvest cloud credentials from the environments where AI systems are built and run. The second finding follows a joint government advisory warning that threat actors are using AI-generated Python exploit scripts to target Siemens S7 programmable logic controllers, the devices that govern physical processes in manufacturing, energy, and utilities, lowering the skill barrier for industrial control system attacks. This briefing follows Five Agencies Warn AI Is Lowering the Bar for ICS Attacks on Critical Infrastructure, a prior advisory covering similar ICS threat patterns, and arrives shortly after CVE-2025-9141 Makes Inference Engines a Governed Security Dependency, which established that AI serving infrastructure now carries material security obligations. Both findings underscore that AI governance programs must extend security controls to the pipeline tooling layer, not just to model outputs.

Why it matters

  • ·MLflow is embedded in AI development workflows across a wide range of industries, meaning the SSRF vulnerability converts AI pipeline tooling into a credential exfiltration vector. Compliance teams that treat AI infrastructure as separate from enterprise security controls now face a documented, actively exploited gap in their attack surface.
  • ·The AI-generated PLC exploit advisory significantly expands the risk perimeter for organizations operating or supplying critical infrastructure. Industrial control system attacks previously required specialized expertise; AI-generated tooling removes that barrier, elevating the threat model for OT environments and triggering obligations under critical infrastructure risk frameworks that compliance teams may not have previously applied to AI-adjacent threats.
  • ·Together, these findings expose a structural gap in most enterprise AI governance programs: controls focus on model behavior and regulatory compliance but do not extend to the security posture of the infrastructure used to develop, track, and serve models. The OWASP Top 10 for Large Language Model Applications flags supply chain and infrastructure risks, but most enterprise programs have not operationalized those controls at the pipeline tooling level.

Stay ahead of stories like this

Get every US AI governance development like this one, plus the rest of the week's developments. Every Thursday.

Free every Thursday. Unsubscribe anytime.

Governance controls affected

AGT-019AI Tool and Plugin Supply Chain Risk AssessmentAGT-023Agentic AI Security Assessment, CBRN and Cyber EspionageSAF-006Post-Deployment Adversarial Testing CadenceSCT-003Critical Infrastructure AI Risk Assessment and ContainmentSEC-003Sensitive Data Handling in AI PipelinesSEC-004AI API Credential Management

What to do now

  • ☐Audit all MLflow deployments for the SSRF vulnerability and apply available patches or mitigations immediately, treating this as an active-exploit incident rather than a scheduled patch cycle.
  • ☐Rotate cloud credentials and API keys accessible from any environment running MLflow, and verify that least-privilege access policies are enforced for all AI pipeline services.
  • ☐Extend your AI system inventory to include model lifecycle tooling such as experiment trackers, model registries, and serving engines, and classify each for security risk exposure.
  • ☐Brief OT/ICS security and compliance teams on the AI-generated PLC exploit advisory and confirm that Siemens S7 devices and adjacent control systems are covered by current patch and monitoring programs.
  • ☐Review your open-source model and AI tooling intake policy to confirm that security patching cadences and vulnerability monitoring cover AI pipeline dependencies, not just the models themselves.

What to watch next

Compliance teams should monitor whether the MLflow SSRF disclosure triggers coordinated guidance from cloud providers or government cybersecurity bodies, as mandatory patch timelines could follow for regulated sectors. The ICS advisory pattern, now appearing across multiple intelligence sources, signals that AI-generated exploit tooling for OT environments is becoming a sustained threat category rather than an isolated incident, and teams should expect follow-on guidance from sector-specific regulators in energy, manufacturing, and defense. Broader AI infrastructure security requirements are also likely to surface in upcoming revisions to AI procurement and vendor risk frameworks, building on the trajectory established by CSA Research Note Sets Security Governance Baseline for Frontier Model Procurement.

Related Coverage

Corporate Policy2026-11-14

FAA's $875M AI Traffic System Rolls Out Without Controller Union Input

The Federal Aviation Administration has deployed its $875 million SMART air traffic management system to all 22 air route traffic control centers across the US. This expands from an initial pilot covering Washington, DC airspace. The system uses cloud-based AI to combine weather, flight path, traffic flow, and staffing data to recommend routes and arrival sequencing. Human FAA specialists validate recommendations before they reach local controllers, who retain final authority over whether to accept them. The National Air Traffic Controllers Association, representing more than 15,000 members, stated it was not consulted in the design, testing, or implementation of SMART.

Corporate Policy2026-11-09

Claude Code Exposed Credentials From 63 Organizations via GitHub

Security researchers at Apiiro found over 100,000 cases of Claude Code's local settings file uploaded to public GitHub repositories. Roughly 1,100 of those files, from 63 organizations, contained secrets including database passwords, API tokens, and private keys. Related bug reports filed as early as August 2025 were closed without action after 60 days of inactivity.

Corporate Policy2026-11-09

Microsoft Agent Security Guide Makes Model Supply Chain a Named Control Requirement

Microsoft has published [Secure autonomous agentic AI systems](https://learn.microsoft.com/en-us/security/zero-trust/sfi/secure-agentic-systems), a guidance document covering how enterprises should select, vet, and monitor the AI models that power their agents. The document addresses model supply-chain governance, adversarial testing, input and output filtering, and controls against unsafe tool use. It directly implicates model inventory programs, version-change approval processes, and ongoing behavioral monitoring in production.