Experiment: Porting a PLC Exploit With AI Takes Hours and Hundreds of Dollars
Researchers at Forescout’s Vedere Labs successfully used Anthropic’s Claude AI to port a remote code execution (RCE) exploit from one WAGO programmable logic controller (PLC) to another. While the initial port was relatively quick, transforming it into a functional command-and-control implant required significant researcher oversight, substantial API costs ($500+), and iterative refinement. The experiment highlights the potential of AI to accelerate exploit development, but also the continued need for human expertise to ensure stability and prevent device damage.
Researchers at Forescout’s Vedere Labs successfully used Anthropic’s Claude AI to port a remote code execution (RCE) exploit from one WAGO programmable logic controller (PLC) to another. The starting point was a previously developed exploit for the WAGO 750-852 PLC, based on CVE-2021-31886, a pre-authentication buffer overflow in the Nucleus FTP server that allows an unauthenticated attacker to execute arbitrary ARM shellcode on the targeted PLC. The experiment aimed to see if the AI could adapt this exploit to a related but distinct model, the WAGO 750-831, and then push the result further into a full command-and-control implant.
Researchers used Claude Code, providing it with access to a terminal, reference files, and the reverse-engineering tool Ghidra, and the physical target device. The AI initially confirmed the vulnerability through a mix of live probing and static firmware analysis before generating a payload that crashed the PLC. The crash confirmed the flaw was present, but this was the easy part of the exercise. Transforming it into controlled code execution took far longer, and early attempts sent the AI chasing incorrect leads, requiring researchers to redirect its analysis and provide additional technical context.
Progress stalled until the team switched from Claude Sonnet 4.6 to Claude Opus 4.6 and instructed the model to ask for help whenever it was uncertain about a firmware detail. The breakthrough came when the AI figured out why the injected code kept getting erased before it could run, then adjusted its approach to keep the payload intact.
Once that obstacle was cleared, Claude produced two separate working payloads within 12 minutes. Forescout noted that the pattern — a difficult, time-consuming path to initial execution followed by rapid iteration afterward — is what makes the cost of scaling this kind of work worth watching. A follow-up attempt to build on the RCE went less smoothly. In a new session aimed at developing a command-and-control implant, Claude tested increasingly complex payloads, and one of those payloads wrote to a region mapped to the PLC’s flash memory, permanently bricking the device.
Forescout noted that the final stage of RCE development alone consumed over $500 in API usage across a session lasting more than eight hours. “One could argue that the [researcher guiding the AI] could have achieved the initial RCE port without AI in less time and at lower cost while also keeping the PLC alive,” Forescout noted, adding, “That is true right now, but the more important question is what happens as the amount of expert intervention required continues to fall. A human researcher can parallelize this work, but AI has the potential to reduce the marginal cost of doing so across many related targets at once.”
Related: Hackers Using AI to Target Siemens PLCs in Critical US Sectors
Related: CISA Urges Water Sector to Protect OT After Coordinated Attacks on PLCs
Related: CISA: Over 100 Internet-Exposed Water Systems Targeted in July Cyberattacks