AI Ports RCE Exploit Across PLCs: 8 Hours, $535, One Bricked…

Forescout researchers used generative AI to port a known exploit from one WAGO PLC to a related model. Cost and time remain high, but the curve is shifting.

On September 1, 2026, Forescout Vedere Labs published an experiment measuring how much generative AI can lower the barrier to exploit development for industrial embedded systems. They ported a known remote code execution exploit from the WAGO 750-852 PLC to the 750-831 model, assisted by the Claude Sonnet 4.6 and Opus 4.6 models. The operation took 8 hours and 32 minutes and consumed $535.74 in API tokens. A subsequent attempt to extend the exploit to a command-and-control implant permanently bricked the target device.

The result raises a strategic question for critical infrastructure security: it is no longer safe to assume that the technical difficulty and cost of embedded exploit development automatically protect exposed controllers. At stake is the validity of the "too hard to exploit" criterion that still drives many OT patching priorities.

Key Takeaways

Forescout Vedere Labs successfully ported an RCE exploit from one WAGO PLC to a related model using generative AI, demonstrating that the technical barrier for embedded exploitation is falling
The process required 8 hours and 32 minutes and $535.74 in API tokens, with constant human guidance to correct false leads and provide disassembly context
A post-exploitation attempt with a C2 implant caused permanent bricking of the PLC, highlighting the fragility of physical devices during AI-assisted testing
Once initial code execution was achieved, AI generated multiple working network payloads within minutes, indicating that post-exploitation can accelerate dramatically

The Mechanism: From USER+QUIT to Preserved Shellcode

The target vulnerability is CVE-2021-31886, a pre-authentication buffer overflow in the Nucleus FTP server with a CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, according to the official NVD record. Forescout had already developed the original exploit for the WAGO 750-852, which injected ARM shellcode to rewrite the web interface HTML. The challenge was adapting it to the 750-831, which has different firmware but a related architecture.

The technical breakthrough came from the AI. The original exploit used a USER command sequence followed by QUIT, but the buffer was zeroed by normal FTP processing before control flow reached the shellcode. Claude determined that omitting the CRLF terminator ('\r\n') preserved the buffer long enough for execution. The discovery, described in the official Forescout blog, required disassembly context provided by the researchers and correction of initial false assumptions.

The AI also initially identified a potential separate bug in the FTP command extraction loop, then set it aside to focus on the known CVE. It is unclear whether this represents a separate exploitable vulnerability; Forescout stated it has been reserved for separate investigation.

The Cost Paradox: Single Target Irrational, Scale Appetizing

The most counter-intuitive data point from the experiment is economic. $535.74 and 8.5 hours for a single exploit on a single PLC model represents an investment higher than what an experienced researcher might charge without AI for a comparable target. The unit cost makes the attack technically possible but economically irrational for individual victims.

The inflection point, according to the research itself, is post-exploitation. Once initial code execution was achieved, the AI generated multiple working network payloads within minutes, at marginal cost. The cost-benefit curve inverts when an attacker can parallelize porting across many related embedded targets: thousands of PLCs exposed on the internet, identifiable via search engines like Shodan, turn scalability into economic appeal.

"Once initial code execution was achieved, AI generated multiple working network payloads within minutes, suggesting that post-exploitation could become increasingly automated as models improve." — Amine Amri and Forescout Research, Vedere Labs

Accidental Bricking: When Testing Touches Physical Hardware

The attempt to extend the exploit to a command-and-control implant caused permanent bricking of the WAGO 750-831. The payload wrote to memory mapped to flash, rendering the device unrecoverable. The incident, which occurred during a controlled test phase, underscores a specific operational risk of AI-assisted exploitation on embedded hardware: the unpredictability of interactions with protected or undocumented memory-mapped regions.

The term "permanently bricked" used by Forescout suggests irreversible hardware damage, not mere software corruption recoverable by reflashing. It is not specified whether the bricking was caused by writing to a protected region or by a payload addressing error. The source does not clarify whether the 750-831 model was patchable or whether the experiment involved known vulnerable firmware.

Threat Calibration: What Changes for OT Defense

The research introduces a new evaluation criterion for OT organizations. The traditional assumption that attackers prefer to engineer protocols rather than invest in complex PLC exploits becomes less reliable as AI reduces the required effort. The "hard to exploit" formula as a reason to deprioritize vulnerabilities loses predictive coherence.

The operational consequences are fourfold. First: recalibration of risk assessment for PLC vulnerabilities currently considered impractical. Second: the need to reduce internet-facing exposure of OT devices, given that visibility on search engines enables scalability. Third: updating incident response plans for rapid exploit porting scenarios across related models. Fourth: investing in defensive AI for firmware triage and detection engineering, keeping human experts in the loop for safety-critical decisions.

The asymmetric dimension remains central. The offense must succeed once; the defense must protect always. AI is compressing this asymmetry on the exploit development front, not yet on distributed defense.

What to Do Now

Recalibrate patching priority for PLC vulnerabilities with high CVSS but historically classified as "difficult to exploit," considering that AI-assisted exploitation is lowering the technical barrier for porting across related models
Reduce the internet-facing attack surface of OT devices, given that public visibility on search engines turns single exploits into economically appetizing scalable campaigns
Update incident response plans to include scenarios of rapid exploit porting across related product families, not just for the originally documented vulnerability
Invest in defensive AI capabilities for firmware triage and detection engineering, keeping human experts in the loop for validation of safety-critical decisions

The research does not document specific remedial measures by vendor WAGO nor a dedicated security advisory for the 750-831 model. The potential additional bug initially identified by the AI in the FTP loop has not been disclosed as a confirmed vulnerability. The source does not specify whether the bricking was communicated to the manufacturer as a responsible test result.

Questions and Answers

Why did the experiment use a 2021 CVE instead of a zero-day?

Forescout's goal was to test AI-assisted porting capability across PLC models, not to demonstrate autonomous vulnerability discovery. The choice of CVE-2021-31886 isolated the variable "AI as productivity multiplier" from the variable "AI as bug researcher." The result shows that AI accelerates adaptation, not necessarily initial discovery.

Is the $535 cost low or high for an attacker?

High for a single target, appetizing for scale. The relevant comparison is not with zero cost but with the cost of an experienced researcher without AI: likely lower for a unique target, but not scalable without replicating the expert. AI makes replication of know-how marginal cost, and that changes the incentive structure.

Is the PLC bricking a risk for real OT operators?

The bricking in this case was a controlled test incident, not a production attack. However, it highlights that AI unpredictability on embedded systems with complex memory mapping can cause permanent physical damage even in defensive scenarios, such as authorized red teaming. Operators should evaluate test protocols that isolate physical hardware or use emulators where possible.

Forescout's research sets a measurable benchmark in a field hitherto dominated by speculation. The core message, expressed by the researchers themselves, is that AI progression toward industrial embedded systems has begun, that substantial barriers remain, and that the cost curve is changing in a non-linear way. The question for defense is not whether to respond, but how soon the economic convenience of a single attack will cross the scalability threshold that makes it systemic.

Information has been verified against cited sources and is current as of publication.

Sources

Sources and references

Get DeafLetter