High
AI Security, ICS, PLC, WAGO, Claude, OT
Researchers Used Claude to Port a PLC RCE Exploit
Forescout used Claude to port a pre-auth RCE exploit between WAGO PLCs, running shellcode on live hardware. What the Claude PLC RCE exploit research shows.
Forescout's Vedere Labs used Anthropic's Claude to port a working pre-authentication remote code execution exploit from one WAGO programmable logic controller (PLC) to another, running attacker-supplied shellcode on live industrial hardware. The exploit targets CVE-2021-31886, a stack-based buffer overflow (CVSS 9.8, CWE-787) in the Nucleus FTP server's handling of the USER command, reachable before authentication over TCP port 21. The demonstration matters less for the old CVE and more for the method: an AI coding agent, given the right tools and steering, moved a real OT exploit onto new hardware.
The setup was deliberately realistic. Researchers gave Claude Code access to a terminal, the reverse-engineering tool Ghidra, and a physical WAGO 750-831 as the live target, plus an existing exploit for the related 750-852 and the 831's firmware binary. The work started on Claude Sonnet 4.6 and moved to Claude Opus 4.6, and the RCE development stage consumed $535.74 in API usage over an eight-and-a-half-hour session. Forescout is candid about the limits: the port needed sustained human steering, and a later attempt to extend it into a command-and-control implant wrote to a flash-mapped region and permanently bricked the PLC.
Does this mean AI can now hack industrial systems on its own?
Not autonomously, and the researchers say so plainly. Forescout notes that an experienced human could likely have ported the exploit faster, cheaper, and without bricking the device, so this is AI as a force-multiplier for a skilled operator, not a push-button OT weapon. The realistic near-term risk is that AI lowers the effort and skill needed to adapt existing exploits across the many near-identical PLC models in the field, which is exactly the repetitive, model-to-model work that slows attackers down today.
What should OT owners do about CVE-2021-31886?
Assume no patch is coming and reduce exposure. CERT@VDE says no updates are available for the affected WAGO controllers, so mitigation is the only path: disable or block FTP on TCP port 21, enforce network segmentation so the PLC is not broadly reachable, and monitor traffic for anomalies.
Item | Detail |
|---|---|
Technique | AI-assisted porting of a pre-auth RCE across PLC models |
Tool | Claude (Sonnet 4.6 then Opus 4.6) with terminal, Ghidra, live PLC |
Target CVE | CVE-2021-31886, Nucleus FTP USER overflow, CVSS 9.8, port 21 |
Hardware | WAGO 750-852 exploit ported to WAGO 750-831 |
Cost and time | $535.74 in API usage over 8h 32m for the RCE stage |
Patch status | No update per CERT@VDE; block FTP/21, segment, monitor |
Notable failure | A C2 extension attempt bricked the PLC |
Our read
The headline is not that AI broke a PLC, it is that AI compresses the tedious part of attacking OT: adapting a known exploit to the next near-identical device. That is a supervised-adversary-simulation problem, because the defensive question is no longer "is this exact model exploitable" but "how quickly could an attacker reuse a neighbor's exploit against ours." For OT operators sitting on unpatchable controllers, the durable answer is exposure reduction and continuous verification of segmentation, since the flaw will not be fixed and the effort to weaponize it is trending down.
Reporting by The Hacker News; research and cost figures per Forescout Vedere Labs; CVSS per NVD and the Siemens/CERT@VDE advisory. Sources linked above.
Related: AI agent security in 2026 and How to prioritize vulnerabilities.