AI Significantly Reduces Time and Cost to Port PLC Exploits, Researchers Find
Forescout researchers successfully adapted a PLC exploit using AI, demonstrating a potential new threat vector for industrial control system attacks.
Researchers at Forescout’s Vedere Labs have successfully demonstrated that artificial intelligence can drastically reduce the time and cost associated with porting exploits between industrial control system devices, specifically Programmable Logic Controllers (PLCs). In an experiment using Anthropic's Claude AI, the team adapted a known remote code execution (RCE) exploit for one WAGO PLC model to a different, yet related, model.
The experiment began with an existing exploit targeting the WAGO 750-852 PLC, which leveraged CVE-2021-31886. This vulnerability, a pre-authentication buffer overflow in the Nucleus FTP server, allows attackers to execute arbitrary ARM shellcode. The goal was to adapt this exploit for the WAGO 750-831 model and explore its potential for developing a full command-and-control implant, a critical concern in the wake of recent attacks on water sector PLCs.
To achieve this, the researchers provided Claude Code with access to a terminal, relevant reference files, the reverse-engineering tool Ghidra, and direct access to the physical target device. The AI was tasked with confirming the vulnerability and generating a functional exploit. Initial attempts by the AI successfully confirmed the presence of the vulnerability by causing the PLC to crash, but translating this into controlled code execution proved challenging.
Early stages of the experiment saw the AI pursuing incorrect leads, necessitating significant intervention and guidance from the human researchers. Progress stalled until the team upgraded to Claude Opus 4.6 and instructed the AI to explicitly request assistance when uncertain about firmware details. This change proved pivotal, leading to a breakthrough when the AI identified and resolved an issue where injected code was being prematurely erased.
Once the code persistence issue was resolved, Claude rapidly produced two distinct, working RCE payloads within a mere 12 minutes. This pattern—an initial difficult and time-consuming phase followed by rapid iteration—is what researchers highlight as a key area for monitoring. The ability to quickly iterate on a confirmed exploit could significantly lower the barrier to entry for attackers targeting industrial environments.
A subsequent attempt to build upon the RCE by developing a command-and-control implant proved more complex. During this phase, one of Claude's more advanced payloads inadvertently wrote to the PLC's flash memory, permanently bricking the device. This incident underscores the inherent risks and the need for careful oversight when using AI for exploit development, even in controlled research settings.
The financial cost of the experiment was also significant, with the final RCE development stage alone consuming over $500 in API usage across more than eight hours of researcher-guided AI work. While a human researcher might have achieved the initial port faster and cheaper, Forescout emphasizes that the true concern lies in the future potential of AI to reduce the marginal cost of parallelizing such efforts across numerous related targets.
This experiment serves as a stark warning about the evolving threat landscape for industrial control systems. As AI tools become more sophisticated and accessible, the ability for threat actors to rapidly develop and deploy tailored exploits against critical infrastructure like energy, water, and manufacturing sectors could increase dramatically, necessitating proactive defense strategies and continuous monitoring.