# AI Experiment: Porting a PLC Exploit Takes Hours and Hundreds of Dollars > Source: > Published: 2026-09-02 04:11:55+00:00 ## 1. Basic Information - **Article Title**: Experiment: Porting a PLC Exploit With AI Takes Hours and Hundreds of Dollars - **Publisher**: SecurityWeek - **Publication Date**: September 1, 2026 - **Source URL**: [SecurityWeek](https://www.securityweek.com/experiment-porting-a-plc-exploit-with-ai-takes-hours-and-hundreds-of-dollars/) - **Related Source**: [Forescout Vedere Labs](https://www.forescout.com/blog/can-ai-create-plc-attacks-yes-but-it%E2%80%99s-not-that-easy-yet/) - **Related Technologies, Products, and Datasets**: CVE-2021-31886, WAGO 750-852, WAGO 750-831 firmware V01.04.16, Nucleus FTP server, Claude Sonnet 4.6, Claude Opus 4.6, Ghidra - **Severity**: Medium - **Report Type**: defense_research ## 2. Executive Summary Forescout combined Claude, Ghidra, and physical hardware to port a CVE-2021-31886 exploit from the WAGO 750-852 to the 750-831 model. Achieving remote code execution (RCE) required continuous human support, 8 hours and 32 minutes, and $535.74. During C2 implant expansion, an incorrect write to flash memory permanently bricked the PLC. ## 3. Defense Challenges - Closed-source embedded PLCs without debuggers require a deep understanding of firmware-specific memory layouts and processing paths to port buffer overflows between models. - AI-driven exploit development capabilities must be evaluated not only by success rates, but also by required human support, time, cost, and physical hardware damage. ## 4. Proposed Methodology - Feed an existing WAGO 750-852 exploit along with the 750-831 physical hardware and firmware into Claude, giving it access to a terminal, Ghidra, generated Python analysis scripts, and network tools. - Humans correct dead ends, provide necessary disassembly context, and prompt the AI when firmware details are uncertain. ## 5. Inputs - Existing WAGO 750-852 exploit for CVE-2021-31886. - WAGO 750-831 firmware V01.04.16 and physical hardware. - Claude Code, Claude Sonnet 4.6 / Opus 4.6, Ghidra, terminal, and network tools. ## 6. Outputs - Pre-authentication RCE exploit for the WAGO 750-831. - UDP payloads delivering an ICMP echo payload and the "PWNED" string. - Records of working hours, API costs, human interventions, failures, and physical device damage. ## 7. Workflow - Analyze the existing exploit and firmware to confirm the presence of an FTP USER buffer overflow using live probing and static analysis. - Reproduce the crash via a Denial of Service (DoS) and attempt to transition to controllable code execution. - Have a human correct incorrect hypotheses, switch to Claude Opus 4.6, and add necessary disassembly context. - Identify the root cause where standard FTP processing zeros out the shellcode. - Preserve the buffer using a USER->CWD sequence and omitted CRLF, then execute the ARM shellcode. - Generate ICMP and UDP payloads after establishing RCE, expanding into a C2 implant in a separate session. - Record the exact point of PLC failure caused by an incorrect flash write during C2 expansion, and evaluate it as a safety limit. ## 8. Evaluation Design - **Target**: Porting a single exploit from the WAGO 750-852 to the 750-831. - **Environment**: Closed-source firmware, no target debugger, physical PLC, FTP port 21. - **Metrics**: Successful RCE; nature of human intervention; time for final stage; API costs; payload derivation time; physical hardware damage. - **Comparison Boundary**: No controlled comparison against humans working alone was performed; the researchers noted that a human working alone might have been faster and cheaper. ## 9. Results - Successfully executed arbitrary ARM shellcode without authentication on the WAGO 750-831. - The final stage required 8 hours and 32 minutes and cost $535.74. - Created two network payloads in 12 minutes after solving target-specific buffer retention issues. - Permanently bricked the PLC during C2 implant development due to an accidental write to flash memory. ## 10. Operational Implications - The process currently requires expert assistance and high costs, making it no easier than traditional methods. - Payload derivation after initial RCE is fast, and improving model capabilities may lower the cost of deployment to related targets in the future. - Even defensive AI agents can cause physical and operational impacts if they malfunction when given write access to cyber-physical systems. ## 11. Success Conditions - Access to the reference exploit, target firmware, and physical hardware. - Human capability to supply firmware-specific disassembly and correct false hypotheses. - An isolated lab environment capable of repeatedly observing network and memory behavior. ## 12. Constraints and Limitations - This case study covers only a single vendor, a single CVE, and a single target, and cannot be generalized. - There is no controlled comparison against humans alone or other AI models. - The lack of a target debugger, combined with context window limits and false hypotheses, prolonged the trial-and-error process. - The C2 implant was never completed, as the experiment ended due to hardware destruction. ## 13. Deployment and Operational Guidance - Conduct OT exploit testing in a lab physically and network-isolated from production environments. - Minimize network, memory, and firmware write permissions for AI agents, and establish clear stop conditions and human approval gates. - Disable unnecessary FTP services on PLCs and block port 21 traffic from IT and external networks. - Monitor for crashes, reboots, ICMP/UDP beacons, and configuration or firmware changes. ## 14. Required Evidence and Records - Logs of models, versions, prompts, tools, and context windows. - Firmware hashes, physical hardware models and versions, and network topologies. - All FTP requests, crashes, uptimes, and ICMP/UDP packet captures. - Human interventions, time spent, token usage, and API costs. - Memory and flash states before and after hardware destruction, alongside recovery viability. ## 15. Facts / Inference / Hypothesis ### Facts - Forescout used AI assistance to port an existing RCE exploit for the WAGO 750-852 to the 750-831, executing arbitrary ARM shellcode via a pre-authentication FTP USER buffer overflow. - The final RCE development stage took 8 hours and 32 minutes with an API cost of $535.74, spanning multiple days with human-provided disassembly context and correction instructions. - The issue where the FTP process cleared the shellcode was resolved by omitting the CRLF terminator and changing the sequence to USER -> CWD. - After overcoming this barrier, Claude created two payloads—an ICMP echo and a UDP packet sending the "PWNED" string—in 12 minutes. - During C2 implant expansion, a payload wrote to a region mapped to flash memory, permanently damaging the WAGO 750-831. ### Inference - While AI strongly relies on expert support to solve target-specific initial exploit hurdles, it can accelerate payload derivation once code execution is established. - OT defenders' assumption that difficult exploits represent low-reality threats must be re-evaluated as model capabilities and automation advance. ### Hypothesis - The suggestion that marginal costs for parallel ports to similar PLCs will decrease in the future is a projection and cannot be quantified based solely on this experiment. ## 16. MITRE ATT&CK Mapping - Since this research did not observe active threat actor operations, no forced mapping is applied. ## 17. Unknowns and Further Research - Reproducibility across other vendors, CPU architectures, and firmware versions. - Strict time and cost comparisons against humans alone, other models, and environments with or without debuggers. - The extent to which AI agent permission constraints can prevent physical hardware damage. ## 18. Impact on SOCs In manufacturing, building automation, and water treatment environments, if legacy PLC FTP services remain reachable from IT/OT boundaries, organizations may be impacted by AI-assisted cross-model exploit porting. Organizations must map their assets, firmware, and service reachability, and ensure that AI-driven testing environments enforce physical safety, network isolation, write restrictions, and explicit stop conditions. ## 19. Summary by Role - **SOC Analysts**: Monitor for abnormal FTP USER lengths, PLC crashes, ICMP/UDP beacons, and service reachability; do not dismiss difficult exploits from threat models. - **Administrators**: Disable and isolate unnecessary FTP services on PLCs, apply firmware updates, restrict inbound traffic from external and IT networks, and establish safety boundaries for testing hardware. - **End Users**: This is not an attack that general users handle directly. Promptly report any abnormal PLC stoppages or suspicious network activity to maintenance personnel.