AI helps port PLC exploit after hours and $500 in API fees

Forescout’s Vedere Labs used Anthropic’s Claude to adapt a remote code execution (RCE) exploit from a WAGO 750-852 programmable logic controller to a related WAGO 750-831. The team confirmed the same pre-authentication buffer overflow in the Nucleus FTP server on the 750-831 and converted a proof-of-concept into working payloads after extensive interaction with the AI.

The starting point was CVE-2021-31886, a flaw that can allow an unauthenticated attacker to run arbitrary ARM shellcode on affected WAGO PLCs. Researchers aimed to port that exploit to the 750-831 and then explore whether the AI could extend the port into a command-and-control implant. The work took place amid recent attacks on programmable logic controllers in the water sector and follow-up warnings from U.S. cybersecurity authorities about industrial control system risks.

Forescout ran the experiment using Claude Code, giving the model access to a terminal, reference files, the reverse-engineering tool Ghidra and the physical device. The AI performed a mix of live probing and static firmware analysis and produced a payload that crashed the PLC, confirming the vulnerability. Achieving controlled code execution required more work: early AI attempts followed incorrect leads and researchers redirected the model and supplied additional technical context.

Progress increased after the team switched from Claude Sonnet 4.6 to Claude Opus 4.6 and instructed the model to request help when uncertain about firmware details. The AI identified why injected code was being erased before it could run and changed its method to preserve the payload. After that change, Claude produced two separate working payloads within 12 minutes.

Forescout reported that the final stage of developing the RCE port consumed more than $500 in API usage and took a session that lasted over eight hours. The company acknowledged that a skilled human researcher could likely have completed the initial port faster, at lower cost and without damaging the device. Forescout wrote: “One could argue that the [researcher guiding the AI] could have achieved the initial RCE port without AI in less time and at lower cost while also keeping the PLC alive.” The team added that reductions in required expert intervention could affect the marginal cost of adapting exploits across related targets.

A follow-up session attempting to build a command-and-control implant did not succeed. Claude tested increasingly complex payloads and one write operation targeted a region mapped to the PLC’s flash memory, permanently bricking the device. Forescout’s record shows the AI can accelerate some stages of exploit development but can also perform destructive operations on hardware when testing volatile payloads.

The experiment combined automated analysis with sustained expert oversight to validate, debug and direct the AI’s work. The researchers documented technical steps, model versions used, and costs associated with the session, and noted the operational and economic trade-offs of using large language models for exploit adaptation on industrial control devices.