AI Exploit Porting: Fast, Costly, Still Needs Humans

What if the most dangerous thing an AI could do wasn't writing malware from scratch, but adapting existing exploit code to work on slightly different hardware? That's the question researchers at Forescout's Vedere Labs set out to answer, using Anthropic's Claude to port a known remote code execution (RCE) exploit from one industrial controller to another. The result: success, but not the kind of effortless automation that keeps security teams up at night — at least, not yet.

Starting with a working exploit for the WAGO 750-852 PLC, the team tasked Claude with making it run on a different model, the WAGO 750-831. The researchers wanted to see not just if the AI could do it, but what it would take in terms of time, money, and human oversight. Their findings offer a realistic picture of AI-assisted exploit development in operational technology (OT) — powerful, but far from a magic button.

The Starting Point: A Known Flaw

The experiment began with CVE-2021-31886, a pre-authentication buffer overflow in the Nucleus FTP server used by certain WAGO PLCs. This vulnerability allows an unauthenticated attacker to execute arbitrary ARM shellcode on the targeted device. Forescout had previously developed a working exploit for the WAGO 750-852, and the challenge was to adapt that exploit to the WAGO 750-831 — a related but distinct model.

The exercise was conducted against the backdrop of recent attacks targeting PLCs in the water sector, a context that underscores the real-world stakes of exploit development in OT environments. If AI can speed up the process of turning known vulnerabilities into working attacks, defenders in critical infrastructure may face a tougher landscape.

Guiding the AI Step by Step

The researchers used Claude Code, giving it access to a terminal, reference files, the reverse-engineering tool Ghidra, and the physical target device. The AI began by confirming the vulnerability through a mix of live probing and static firmware analysis. It generated a payload that crashed the PLC, proving the flaw was present.

But crashing the device was the easy part. Turning that crash into controlled code execution took far longer. Early attempts sent the AI down incorrect leads, requiring researchers to redirect its analysis and provide additional technical context. This pattern — a difficult path to initial execution, followed by rapid iteration — is what makes the cost of scaling this kind of work worth watching.

“One could argue that the [researcher guiding the AI] could have achieved the initial RCE port without AI in less time and at lower cost while also keeping the PLC alive,” Forescout noted, adding, “That is true right now, but the more important question is what happens as the amount of expert intervention required continues to fall. A human researcher can parallelize this work, but AI has the potential to reduce the marginal cost of doing so across many related targets at once.”

— Forescout’s Vedere Labs

The Breakthrough: Switching Models

Progress stalled until the team switched from Claude Sonnet 4.6 to Claude Opus 4.6 and instructed the model to ask for help whenever it was uncertain about a firmware detail. The breakthrough came when the AI figured out why the injected code kept getting erased before it could run, then adjusted its approach to keep the payload intact.

Once that obstacle was cleared, Claude produced two separate working payloads within 12 minutes. The rapid iteration after the initial hurdle suggests that AI can accelerate the later stages of exploit development — once the hard problems are solved, the AI can churn out variations quickly.

When the AI Bricked the PLC

The follow-up attempt to build on the RCE went less smoothly. In a new session aimed at developing a command-and-control implant, Claude tested increasingly complex payloads. One of those payloads wrote to a region mapped to the PLC’s flash memory, permanently bricking the device.

The loss of the hardware is a reminder that working with physical OT devices carries real consequences. Unlike a virtual machine or a sandbox, a PLC cannot simply be reset — a mistake can destroy the device. This is a significant barrier to AI-driven experimentation in OT, as each failure may come with a hardware cost.

The Price of Progress

The costs associated with the experiment are notable. Forescout noted that the final stage of RCE development alone consumed over $500 in API usage across a session lasting more than eight hours. This figure does not include the earlier stages of the work or the human researcher time involved.

The expense highlights that AI-assisted exploit development is not yet a cheap, commoditized activity. But the trend is clear: as the amount of expert intervention required continues to fall, the marginal cost of targeting many related devices at once could drop dramatically. The researchers explicitly note that AI has the potential to reduce the marginal cost of this work across many related targets simultaneously.

What This Means for Defenders

The experiment shows that AI is not yet a shortcut to exploit development — it required significant human expertise, time, and money, and it destroyed hardware along the way. But it also points to a future where the barrier to entry for OT attacks may be lower. As AI tools improve, the cost of turning a known vulnerability into a working exploit could decline, potentially enabling attackers to target multiple device models with less effort.

For organizations running WAGO PLCs or similar industrial controllers, this suggests that AI-assisted exploit development is a realistic threat to consider. The pace at which AI can adapt exploits across similar devices could shrink the window for patching and mitigation. Defenders should prioritize patching known vulnerabilities and monitoring for signs of exploitation, especially in OT environments where devices are often difficult to update.

While this experiment involved a single vulnerability and a single model, the implications may extend far beyond. If AI can port exploits across many related targets at once, the cost of attacking critical infrastructure could fall — a development worth watching closely.