With $500 and Claude, Researchers Cloned a PLC Exploit From One…

Forescout Vedere Labs researchers used Anthropic Claude to port an RCE exploit from one WAGO PLC model to another in the same family, confirming that AI lowers the cost of customizing OT attacks from a bespoke operation to a potentially scalable process. The experiment, conducted against the backdrop of recent attacks on municipal water systems, required more than eight hours of session time and consumed over $500 in API usage for the final RCE development phase alone, with an initial attempt to expand toward a command-and-control implant permanently bricking the device.

Key Takeaways

Forescout successfully ported an exploit for CVE-2021-31886 from the WAGO 750-852 PLC to the 750-831 model using Claude Sonnet and then Opus 4.6
The technical breakthrough occurred when the AI autonomously understood why the injected code was being wiped before execution, producing two working payloads in 12 minutes
API costs for the final RCE phase alone exceeded $500 across a session of more than eight hours, with extensive human guidance and an AI model swap
A subsequent attempt to develop a C2 implant caused permanent bricking of the PLC by writing to a memory region mapped to flash

From Crash to Code Execution: How AI Overcame the Technical Hurdle

The experiment started from CVE-2021-31886, a pre-authentication buffer overflow in the Nucleus FTP server rated CVSS 9.8 CRITICAL by the National Vulnerability Database, which allows arbitrary ARM shellcode execution. The vulnerability was already known on the WAGO 750-852 model; the goal was to adapt it to the 750-831.

The AI confirmed the vulnerability through live probing and static firmware analysis with Ghidra, the industry-standard reverse engineering tool. The jump from a simple crash to controlled code execution was not immediate: researchers had to switch from Claude Sonnet 4.6 to Claude Opus 4.6 and explicitly instruct the model to ask for help when uncertain, redirecting it multiple times from faulty analytical leads.

The decisive breakthrough came when Claude autonomously grasped why the injected code was being wiped before execution, adjusting its approach accordingly. According to the primary source, after this point the model produced two working payloads in 12 minutes.

The Real Cost: $500 and a Worrying Scalability Curve

Forescout precisely quantified the costs of the final RCE development phase: over $500 in API usage spread across a session of more than eight hours. The figure matters not for its absolute amount, which remains modest compared to a traditional nation-state operation, but for what it implies about the marginal cost curve.

The source explicitly notes that a human researcher could have completed the initial port in less time and at lower cost, leaving the PLC intact. The structural question the researchers raise, however, is different: the first exploit costs $500 and requires eight hours of expert supervision, but the hundredth related target could cost significantly less in human intervention, transforming OT targeting from an artisanal skill into a technically parallelizable commodity.

"That is true right now, but the more important question is what happens as the amount of expert intervention required continues to fall. A human researcher can parallelize this work, but AI has the potential to reduce the marginal cost of doing so across many related targets at once." — Forescout Vedere Labs, quoted by SecurityWeek

Accidental Bricking: When Automation Meets Physical Hardware

A subsequent attempt to develop a command-and-control implant caused permanent damage. The payload wrote to a memory region mapped to the PLC's flash, irreversibly bricking the device. The incident, which occurred in a controlled research environment, highlights a risk often overlooked in the discussion of AI for OT security: accelerated exploit development via automation can generate physical damage before a human operator can intervene.

The dossier does not specify whether the bricking is recoverable through hardware restoration procedures or whether the device is permanently compromised. This gap does not reduce the episode's relevance: in a real critical infrastructure context, an equivalent error on a production PLC would have immediate operational consequences, regardless of the actor's intent.

Real-World Threat Context: From Advisory AA26-231A to the Water Sector

The Forescout experiment was conducted in the context of recent attacks on more than 30 municipal water systems in Minnesota, reported by the secondary source Cloud Security Alliance. In parallel, the government advisory AA26-231A dated August 19, 2026 — signed by NSA, CISA, FBI, DOE, and EPA — documents actors using AI to generate exploit scripts against Siemens S7 PLCs from publicly available information.

It is necessary to distinguish precisely: advisory AA26-231A describes AI-assisted script generation, not exploit porting between correlated hardware models as demonstrated by Forescout. The two phenomena are technically distinct — generating scripts from public documentation is less sophisticated than firmware reverse-engineering-guided RCE porting — but they converge on the same strategic trend: lowering the expertise barrier for attacking OT devices.

The Cloud Security Alliance places this trend in a historical line that includes Stuxnet (2010), Industroyer (2016), and TRITON (2017), underscoring how the addition of AI accelerates an existing dynamic rather than creating one from scratch.

Why It Matters

The dossier does not specify specific mitigations for this threat type. The primary source does not document success rates on other PLC models or vendors beyond WAGO, nor does it quantify the total experiment time beyond the final RCE phase alone. It is unknown whether real threat actors are already using technically equivalent approaches to Forescout's: advisory AA26-231A describes an earlier stage of the attack chain, not automated exploit porting between correlated hardware.

The most relevant limitation concerns reproducibility: the dossier does not clarify whether the method is transferable to other large language models or Claude versions other than those tested. This element of uncertainty does not weaken the strategic reading: if the constraint is tied to a specific reasoning capability of Claude Opus 4.6, the barrier is technical and temporary; if it is intrinsic to the complexity of OT reverse engineering, the scalability margin remains more contained.

The primary source also does not document whether the method was tested on firmware with anti-tamper protections or on architectures other than ARM, an element that delimits the perimeter of immediate applicability.

Frequently Asked Questions

Did the AI create the exploit from scratch without human intervention?: No. The primary source describes "extensive researcher oversight" with multiple redirects of the AI from faulty analytical leads. The switch between AI models and the explicit instruction to ask for help when uncertain indicate constant supervision.
Did the PLC bricking occur during a real attack?: No. It was an accidental incident during controlled laboratory research, not an attack against operational infrastructure.
Does advisory AA26-231A describe exactly the same technique?: No. The advisory documents AI-assisted script generation against Siemens S7, while the Forescout experiment concerns exploit porting between WAGO models via firmware reverse engineering. They are related but distinct phenomena.

Information is based on the cited source and current as of publication.

Sources

Sources and references

Get DeafLetter