AI Experiment: Porting a PLC Exploit Takes Hours and Hundreds of Dollars

#

1. Basic Information

Article Title: Experiment: Porting a PLC Exploit With AI Takes Hours and Hundreds of Dollars #

Publisher: SecurityWeek #

Publication Date: September 1, 2026 #

Source URL: SecurityWeek #

Related Source: Forescout Vedere Labs #

Related Technologies, Products, and Datasets: CVE-2021-31886, WAGO 750-852, WAGO 750-831 firmware V01.04.16, Nucleus FTP server, Claude Sonnet 4.6, Claude Opus 4.6, Ghidra #

Severity: Medium #

Report Type: defense_research

#

2. Executive Summary

Forescout combined Claude, Ghidra, and physical hardware to port a CVE-2021-31886 exploit from the WAGO 750-852 to the 750-831 model. Achieving remote code execution (RCE) required continuous human support, 8 hours and 32 minutes, and $535.74. During C2 implant expansion, an incorrect write to flash memory permanently bricked the PLC.

#

3. Defense Challenges

• Closed-source embedded PLCs without debuggers require a deep understanding of firmware-specific memory layouts and processing paths to port buffer overflows between models.
• AI-driven exploit development capabilities must be evaluated not only by success rates, but also by required human support, time, cost, and physical hardware damage.

#

4. Proposed Methodology

• Feed an existing WAGO 750-852 exploit along with the 750-831 physical hardware and firmware into Claude, giving it access to a terminal, Ghidra, generated Python analysis scripts, and network tools.
• Humans correct dead ends, provide necessary disassembly context, and prompt the AI when firmware details are uncertain.

#

5. Inputs

• Existing WAGO 750-852 exploit for CVE-2021-31886.
• WAGO 750-831 firmware V01.04.16 and physical hardware.
• Claude Code, Claude Sonnet 4.6 / Opus 4.6, Ghidra, terminal, and network tools.

#

6. Outputs

• Pre-authentication RCE exploit for the WAGO 750-831.
• UDP payloads delivering an ICMP echo payload and the "PWNED" string.
• Records of working hours, API costs, human interventions, failures, and physical device damage.

#

7. Workflow

• Analyze the existing exploit and firmware to confirm the presence of an FTP USER buffer overflow using live probing and static analysis.
• Reproduce the crash via a Denial of Service (DoS) and attempt to transition to controllable code execution.
• Have a human correct incorrect hypotheses, switch to Claude Opus 4.6, and add necessary disassembly context.
• Identify the root cause where standard FTP processing zeros out the shellcode.
• Preserve the buffer using a USER->CWD sequence and omitted CRLF, then execute the ARM shellcode.
• Generate ICMP and UDP payloads after establishing RCE, expanding into a C2 implant in a separate session.
• Record the exact point of PLC failure caused by an incorrect flash write during C2 expansion, and evaluate it as a safety limit.

#

8. Evaluation Design

Target: Porting a single exploit from the WAGO 750-852 to the 750-831. #

Environment: Closed-source firmware, no target debugger, physical PLC, FTP port 21. #

Metrics: Successful RCE; nature of human intervention; time for final stage; API costs; payload derivation time; physical hardware damage. #

Comparison Boundary: No controlled comparison against humans working alone was performed; the researchers noted that a human working alone might have been faster and cheaper.

#

9. Results

• Successfully executed arbitrary ARM shellcode without authentication on the WAGO 750-831.
• The final stage required 8 hours and 32 minutes and cost $535.74.
• Created two network payloads in 12 minutes after solving target-specific buffer retention issues.
• Permanently bricked the PLC during C2 implant development due to an accidental write to flash memory.

#

10. Operational Implications

• The process currently requires expert assistance and high costs, making it no easier than traditional methods.
• Payload derivation after initial RCE is fast, and improving model capabilities may lower the cost of deployment to related targets in the future.
• Even defensive AI agents can cause physical and operational impacts if they malfunction when given write access to cyber-physical systems.

#

11. Success Conditions

• Access to the reference exploit, target firmware, and physical hardware.
• Human capability to supply firmware-specific disassembly and correct false hypotheses.
• An isolated lab environment capable of repeatedly observing network and memory behavior.

#

12. Constraints and Limitations

• This case study covers only a single vendor, a single CVE, and a single target, and cannot be generalized.
• There is no controlled comparison against humans alone or other AI models.
• The lack of a target debugger, combined with context window limits and false hypotheses, prolonged the trial-and-error process.
• The C2 implant was never completed, as the experiment ended due to hardware destruction.

#

13. Deployment and Operational Guidance

• Conduct OT exploit testing in a lab physically and network-isolated from production environments.
• Minimize network, memory, and firmware write permissions for AI agents, and establish clear stop conditions and human approval gates.
• Disable unnecessary FTP services on PLCs and block port 21 traffic from IT and external networks.
• Monitor for crashes, reboots, ICMP/UDP beacons, and configuration or firmware changes.

#

14. Required Evidence and Records

• Logs of models, versions, prompts, tools, and context windows.
• Firmware hashes, physical hardware models and versions, and network topologies.
• All FTP requests, crashes, uptimes, and ICMP/UDP packet captures.
• Human interventions, time spent, token usage, and API costs.
• Memory and flash states before and after hardware destruction, alongside recovery viability.

#

15. Facts / Inference / Hypothesis

Facts

• Forescout used AI assistance to port an existing RCE exploit for the WAGO 750-852 to the 750-831, executing arbitrary ARM shellcode via a pre-authentication FTP USER buffer overflow.
• The final RCE development stage took 8 hours and 32 minutes with an API cost of $535.74, spanning multiple days with human-provided disassembly context and correction instructions.
• The issue where the FTP process cleared the shellcode was resolved by omitting the CRLF terminator and changing the sequence to USER -> CWD.
• After overcoming this barrier, Claude created two payloads—an ICMP echo and a UDP packet sending the "PWNED" string—in 12 minutes.
• During C2 implant expansion, a payload wrote to a region mapped to flash memory, permanently damaging the WAGO 750-831.

Inference

• While AI strongly relies on expert support to solve target-specific initial exploit hurdles, it can accelerate payload derivation once code execution is established.
• OT defenders' assumption that difficult exploits represent low-reality threats must be re-evaluated as model capabilities and automation advance.

Hypothesis

• The suggestion that marginal costs for parallel ports to similar PLCs will decrease in the future is a projection and cannot be quantified based solely on this experiment.

#

16. MITRE ATT&CK Mapping

• Since this research did not observe active threat actor operations, no forced mapping is applied.

#

17. Unknowns and Further Research

• Reproducibility across other vendors, CPU architectures, and firmware versions.
• Strict time and cost comparisons against humans alone, other models, and environments with or without debuggers.
• The extent to which AI agent permission constraints can prevent physical hardware damage.

#

18. Impact on SOCs

In manufacturing, building automation, and water treatment environments, if legacy PLC FTP services remain reachable from IT/OT boundaries, organizations may be impacted by AI-assisted cross-model exploit porting. Organizations must map their assets, firmware, and service reachability, and ensure that AI-driven testing environments enforce physical safety, network isolation, write restrictions, and explicit stop conditions.

#

19. Summary by Role

SOC Analysts: Monitor for abnormal FTP USER lengths, PLC crashes, ICMP/UDP beacons, and service reachability; do not dismiss difficult exploits from threat models. #

Administrators: Disable and isolate unnecessary FTP services on PLCs, apply firmware updates, restrict inbound traffic from external and IT networks, and establish safety boundaries for testing hardware. #

End Users: This is not an attack that general users handle directly. Promptly report any abnormal PLC stoppages or suspicious network activity to maintenance personnel.

source & further reading

dev.to — original article The Production AI Checklist That Nobody Publishes. The AI Had an Authoritative Source. It Was Still Wrong. AWS MLA-C01 MLA-C02: What Changed (Spoiler: Bedrock Is In)