{"slug": "ai-experiment-porting-a-plc-exploit-takes-hours-and-hundreds-of-dollars", "title": "AI Experiment: Porting a PLC Exploit Takes Hours and Hundreds of Dollars", "summary": "Forescout researchers demonstrated that porting a PLC exploit with AI assistance takes hours and hundreds of dollars, achieving remote code execution on a WAGO 750-831 after 8 hours and 32 minutes at a cost of $535.74. The experiment, which used Claude and Ghidra, also resulted in permanently bricking the PLC due to an incorrect flash write during C2 implant development.", "body_md": "##\n1. Basic Information\n\n-\n**Article Title**: Experiment: Porting a PLC Exploit With AI Takes Hours and Hundreds of Dollars\n-\n**Publisher**: SecurityWeek\n-\n**Publication Date**: September 1, 2026\n-\n**Source URL**: [SecurityWeek](https://www.securityweek.com/experiment-porting-a-plc-exploit-with-ai-takes-hours-and-hundreds-of-dollars/)\n-\n**Related Source**: [Forescout Vedere Labs](https://www.forescout.com/blog/can-ai-create-plc-attacks-yes-but-it%E2%80%99s-not-that-easy-yet/)\n-\n**Related Technologies, Products, and Datasets**: CVE-2021-31886, WAGO 750-852, WAGO 750-831 firmware V01.04.16, Nucleus FTP server, Claude Sonnet 4.6, Claude Opus 4.6, Ghidra\n-\n**Severity**: Medium\n-\n**Report Type**: defense_research\n\n##\n2. Executive Summary\n\nForescout combined Claude, Ghidra, and physical hardware to port a CVE-2021-31886 exploit from the WAGO 750-852 to the 750-831 model. Achieving remote code execution (RCE) required continuous human support, 8 hours and 32 minutes, and $535.74. During C2 implant expansion, an incorrect write to flash memory permanently bricked the PLC.\n\n##\n3. Defense Challenges\n\n- Closed-source embedded PLCs without debuggers require a deep understanding of firmware-specific memory layouts and processing paths to port buffer overflows between models.\n- AI-driven exploit development capabilities must be evaluated not only by success rates, but also by required human support, time, cost, and physical hardware damage.\n\n##\n4. Proposed Methodology\n\n- Feed an existing WAGO 750-852 exploit along with the 750-831 physical hardware and firmware into Claude, giving it access to a terminal, Ghidra, generated Python analysis scripts, and network tools.\n- Humans correct dead ends, provide necessary disassembly context, and prompt the AI when firmware details are uncertain.\n\n##\n5. Inputs\n\n- Existing WAGO 750-852 exploit for CVE-2021-31886.\n- WAGO 750-831 firmware V01.04.16 and physical hardware.\n- Claude Code, Claude Sonnet 4.6 / Opus 4.6, Ghidra, terminal, and network tools.\n\n##\n6. Outputs\n\n- Pre-authentication RCE exploit for the WAGO 750-831.\n- UDP payloads delivering an ICMP echo payload and the \"PWNED\" string.\n- Records of working hours, API costs, human interventions, failures, and physical device damage.\n\n##\n7. Workflow\n\n- Analyze the existing exploit and firmware to confirm the presence of an FTP USER buffer overflow using live probing and static analysis.\n- Reproduce the crash via a Denial of Service (DoS) and attempt to transition to controllable code execution.\n- Have a human correct incorrect hypotheses, switch to Claude Opus 4.6, and add necessary disassembly context.\n- Identify the root cause where standard FTP processing zeros out the shellcode.\n- Preserve the buffer using a USER->CWD sequence and omitted CRLF, then execute the ARM shellcode.\n- Generate ICMP and UDP payloads after establishing RCE, expanding into a C2 implant in a separate session.\n- Record the exact point of PLC failure caused by an incorrect flash write during C2 expansion, and evaluate it as a safety limit.\n\n##\n8. Evaluation Design\n\n-\n**Target**: Porting a single exploit from the WAGO 750-852 to the 750-831.\n-\n**Environment**: Closed-source firmware, no target debugger, physical PLC, FTP port 21.\n-\n**Metrics**: Successful RCE; nature of human intervention; time for final stage; API costs; payload derivation time; physical hardware damage.\n-\n**Comparison Boundary**: No controlled comparison against humans working alone was performed; the researchers noted that a human working alone might have been faster and cheaper.\n\n##\n9. Results\n\n- Successfully executed arbitrary ARM shellcode without authentication on the WAGO 750-831.\n- The final stage required 8 hours and 32 minutes and cost $535.74.\n- Created two network payloads in 12 minutes after solving target-specific buffer retention issues.\n- Permanently bricked the PLC during C2 implant development due to an accidental write to flash memory.\n\n##\n10. Operational Implications\n\n- The process currently requires expert assistance and high costs, making it no easier than traditional methods.\n- Payload derivation after initial RCE is fast, and improving model capabilities may lower the cost of deployment to related targets in the future.\n- Even defensive AI agents can cause physical and operational impacts if they malfunction when given write access to cyber-physical systems.\n\n##\n11. Success Conditions\n\n- Access to the reference exploit, target firmware, and physical hardware.\n- Human capability to supply firmware-specific disassembly and correct false hypotheses.\n- An isolated lab environment capable of repeatedly observing network and memory behavior.\n\n##\n12. Constraints and Limitations\n\n- This case study covers only a single vendor, a single CVE, and a single target, and cannot be generalized.\n- There is no controlled comparison against humans alone or other AI models.\n- The lack of a target debugger, combined with context window limits and false hypotheses, prolonged the trial-and-error process.\n- The C2 implant was never completed, as the experiment ended due to hardware destruction.\n\n##\n13. Deployment and Operational Guidance\n\n- Conduct OT exploit testing in a lab physically and network-isolated from production environments.\n- Minimize network, memory, and firmware write permissions for AI agents, and establish clear stop conditions and human approval gates.\n- Disable unnecessary FTP services on PLCs and block port 21 traffic from IT and external networks.\n- Monitor for crashes, reboots, ICMP/UDP beacons, and configuration or firmware changes.\n\n##\n14. Required Evidence and Records\n\n- Logs of models, versions, prompts, tools, and context windows.\n- Firmware hashes, physical hardware models and versions, and network topologies.\n- All FTP requests, crashes, uptimes, and ICMP/UDP packet captures.\n- Human interventions, time spent, token usage, and API costs.\n- Memory and flash states before and after hardware destruction, alongside recovery viability.\n\n##\n15. Facts / Inference / Hypothesis\n\n###\nFacts\n\n- Forescout used AI assistance to port an existing RCE exploit for the WAGO 750-852 to the 750-831, executing arbitrary ARM shellcode via a pre-authentication FTP USER buffer overflow.\n- The final RCE development stage took 8 hours and 32 minutes with an API cost of $535.74, spanning multiple days with human-provided disassembly context and correction instructions.\n- The issue where the FTP process cleared the shellcode was resolved by omitting the CRLF terminator and changing the sequence to USER -> CWD.\n- After overcoming this barrier, Claude created two payloads—an ICMP echo and a UDP packet sending the \"PWNED\" string—in 12 minutes.\n- During C2 implant expansion, a payload wrote to a region mapped to flash memory, permanently damaging the WAGO 750-831.\n\n###\nInference\n\n- While AI strongly relies on expert support to solve target-specific initial exploit hurdles, it can accelerate payload derivation once code execution is established.\n- OT defenders' assumption that difficult exploits represent low-reality threats must be re-evaluated as model capabilities and automation advance.\n\n###\nHypothesis\n\n- The suggestion that marginal costs for parallel ports to similar PLCs will decrease in the future is a projection and cannot be quantified based solely on this experiment.\n\n##\n16. MITRE ATT&CK Mapping\n\n- Since this research did not observe active threat actor operations, no forced mapping is applied.\n\n##\n17. Unknowns and Further Research\n\n- Reproducibility across other vendors, CPU architectures, and firmware versions.\n- Strict time and cost comparisons against humans alone, other models, and environments with or without debuggers.\n- The extent to which AI agent permission constraints can prevent physical hardware damage.\n\n##\n18. Impact on SOCs\n\nIn manufacturing, building automation, and water treatment environments, if legacy PLC FTP services remain reachable from IT/OT boundaries, organizations may be impacted by AI-assisted cross-model exploit porting. Organizations must map their assets, firmware, and service reachability, and ensure that AI-driven testing environments enforce physical safety, network isolation, write restrictions, and explicit stop conditions.\n\n##\n19. Summary by Role\n\n-\n**SOC Analysts**: Monitor for abnormal FTP USER lengths, PLC crashes, ICMP/UDP beacons, and service reachability; do not dismiss difficult exploits from threat models.\n-\n**Administrators**: Disable and isolate unnecessary FTP services on PLCs, apply firmware updates, restrict inbound traffic from external and IT networks, and establish safety boundaries for testing hardware.\n-\n**End Users**: This is not an attack that general users handle directly. Promptly report any abnormal PLC stoppages or suspicious network activity to maintenance personnel.", "url": "https://wpnews.pro/news/ai-experiment-porting-a-plc-exploit-takes-hours-and-hundreds-of-dollars", "canonical_source": "https://dev.to/anoymask/ai-experiment-porting-a-plc-exploit-takes-hours-and-hundreds-of-dollars-56od", "published_at": "2026-09-02 04:11:55+00:00", "updated_at": "2026-09-02 04:24:19.707380+00:00", "lang": "en", "topics": ["artificial-intelligence", "ai-research", "ai-safety"], "entities": ["Forescout", "Claude", "Ghidra", "WAGO 750-852", "WAGO 750-831", "CVE-2021-31886", "Claude Sonnet 4.6", "Claude Opus 4.6"], "alternates": {"html": "https://wpnews.pro/news/ai-experiment-porting-a-plc-exploit-takes-hours-and-hundreds-of-dollars", "markdown": "https://wpnews.pro/news/ai-experiment-porting-a-plc-exploit-takes-hours-and-hundreds-of-dollars.md", "text": "https://wpnews.pro/news/ai-experiment-porting-a-plc-exploit-takes-hours-and-hundreds-of-dollars.txt", "jsonld": "https://wpnews.pro/news/ai-experiment-porting-a-plc-exploit-takes-hours-and-hundreds-of-dollars.jsonld"}}