AI Model Ports PLC Exploit for $536, Flags New Vulnerability in 8-Hour Test

Researchers used an AI model to port a working exploit from one industrial controller to another, successfully executing malicious code on live hardware and uncovering a potential new security flaw in the process. Forescout Research's Vedere Labs said it deployed Anthropic's Claude to adapt a pre-authentication remote code execution exploit targeting CVE-2021-31886, a critical vulnerability in WAGO programmable logic controllers, completing the work in just over eight hours. The experiment shows how AI tools can automate sophisticated attack development for industrial systems, though the process required constant human oversight and came with significant costs and risks.

The final stage of exploit development consumed $535.74 in API usage over an 8-hour-32-minute session, according to Vedere Labs. The team started with a working exploit for the WAGO 750-852 controller and ported it to a WAGO 750-831 running firmware V01.04.16, supplying Claude with the original exploit code, a firmware binary, and access to a physical device as the live target. The AI worked through interactive sessions with access to a terminal, the reverse-engineering tool Ghidra, and the target controller, switching from Claude Sonnet 4.6 to Claude Opus 4.6 after initial attempts stalled. A later session that tried to extend the exploit into a command-and-control implant permanently bricked the PLC by writing to a flash-mapped memory region. The vulnerability itself, CVE-2021-31886, is a stack-based buffer overflow in the Nucleus FTP server's handling of the USER command that carries a CVSS score of 9.8 and is accessible before authentication over TCP port 21. CERT@VDE says no updates are available for the affected WAGO controllers and advises owners to disable or block FTP on port 21, enforce segmentation controls, and monitor network traffic for anomalies.

"One could argue that the same researcher could have achieved the initial RCE port without AI in less time and at lower cost while also keeping the PLC alive," Forescout said. The model had to adapt its approach when normal FTP processing on the 750-831 zeroed 256 bytes at the attacker-controlled buffer, overwriting the injected shellcode before it could run. Claude changed the USER and QUIT sequence used against the 750-852 into a USER and CWD sequence, and omitting the CRLF terminator "prevented the relevant processing path from completing in the usual way," allowing the buffer to survive long enough for the payload to execute. Once code execution was established, the model moved from working no-operation shellcode to two functional payloads in 12 minutes, one sending ICMP echo requests to an attacker-controlled system and the other sending a UDP packet containing the string PWNED. The model also flagged a potential bug in the FTP command extraction loop, distinct from CVE-2021-31886, and manual review "suggested that this may be a separate, previously unidentified, vulnerability," though the team set it aside for separate investigation.

The research carries implications for operational technology security at a moment when AI-generated exploitation scripts are moving from theoretical concern to documented capability. A joint advisory issued August 19 by the NSA, CISA, FBI, Department of Energy, and Environmental Protection Agency warned of an active threat to internet-exposed Siemens S7 Series PLCs from AI-generated exploitation scripts, assessing that the activity is likely intended for persistent reconnaissance and capability development. The agencies stated that using AI to generate exploitation scripts "represents an evolution in threat actor capabilities, dramatically reducing the technical expertise and time required to develop working ICS exploitation scripts and malicious tools." CVE-2021-31886 was one of 13 flaws disclosed in November 2021 as NUCLEUS:13 by Forescout and Medigate, and a GitHub repository search run by The Hacker News on September 1 returned no results for the vulnerability, which is also absent from Exploit-DB and Packet Storm. The CERT@VDE advisory lists 11 WAGO models as vulnerable to CVE-2021-31886, all based on Nucleus V1 RTOS, for which no updates are available.

"The more immediate risk is not an agent independently deciding to attack a controller, but an authorized agent taking the wrong action on a physical system where failure has real operational consequences," Forescout concluded. Siemens, which maintains Nucleus, states in its advisory that no remediation is planned for Nucleus NET across all versions, and that Nucleus ReadyStart V3 releases from V2013.08.1 onward already fix the flaw. Vedere Labs has previously shown that remote code execution on a controller can be chained to enable deep lateral movement in operational technology networks, exploiting multiple vulnerabilities in Schneider Electric Modicon PLCs. In its earlier research on chaining PLC exploits, Forescout concluded that the issues discussed "should likely not be near the top of your priority list," and said AI advances should make organizations reconsider that risk calculus. The demonstration underscores a shift where attack automation now competes directly with manual expertise in both speed and cost, though bricking a live system shows the technology still lacks the judgment to navigate physical consequences. Organizations running legacy industrial systems face a narrowing window to harden defenses before adversaries operationalize the same tools at scale.