AI Experiment: Porting a PLC Exploit Takes Hours and Hundreds of Dollars

1. Basic Information

• Article Title: Experiment: Porting a PLC Exploit With AI Takes Hours and Hundreds of Dollars
• Publisher: SecurityWeek
• Publication Date: September 1, 2026
• Source URL: SecurityWeek
• Related Source: Forescout Vedere Labs
• Related Technologies, Products, and Datasets: CVE-2021-31886, WAGO 750-852, WAGO 750-831 firmware V01.04.16, Nucleus FTP server, Claude Sonnet 4.6, Claude Opus 4.6, Ghidra
• Severity: Medium
• Report Type: defense_research

2. Executive Summary

Forescout combined Claude, Ghidra, and physical hardware to port a CVE-2021-31886 exploit from the WAGO 750-852 to the 750-831 model. Achieving remote code execution (RCE) required continuous human support, 8 hours and 32 minutes, and $535.74. During C2 implant expansion, an incorrect write to flash memory permanently bricked the PLC.

3. Defense Challenges

• Closed-source embedded PLCs without debuggers require a deep understanding of firmware-specific memory layouts and processing paths to port buffer overflows between models.
• AI-driven exploit development capabilities must be evaluated not only by success rates, but also by required human support, time, cost, and physical hardware damage.

4. Proposed Methodology

• Feed an existing WAGO 750-852 exploit along with the 750-831 physical hardware and firmware into Claude, giving it access to a terminal, Ghidra, generated Python analysis scripts, and network tools.
• Humans correct dead ends, provide necessary disassembly context, and prompt the AI when firmware details are uncertain.

5. Inputs

• Existing WAGO 750-852 exploit for CVE-2021-31886.
• WAGO 750-831 firmware V01.04.16 and physical hardware.
• Claude Code, Claude Sonnet 4.6 / Opus 4.6, Ghidra, terminal, and network tools.

6. Outputs

• Pre-authentication RCE exploit for the WAGO 750-831.
• UDP payloads delivering an ICMP echo payload and the "PWNED" string.
• Records of working hours, API costs, human interventions, failures, and physical device damage.

7. Workflow

1. Analyze the existing exploit and firmware to confirm the presence of an FTP USER buffer overflow using live probing and static analysis.
2. Reproduce the crash via a Denial of Service (DoS) and attempt to transition to controllable code execution.
3. Have a human correct incorrect hypotheses, switch to Claude Opus 4.6, and add necessary disassembly context.
4. Identify the root cause where standard FTP processing zeros out the shellcode.
5. Preserve the buffer using a USER->CWD sequence and omitted CRLF, then execute the ARM shellcode.
6. Generate ICMP and UDP payloads after establishing RCE, expanding into a C2 implant in a separate session.
7. Record the exact point of PLC failure caused by an incorrect flash write during C2 expansion, and evaluate it as a safety limit.

8. Evaluation Design

• Target: Porting a single exploit from the WAGO 750-852 to the 750-831.
• Environment: Closed-source firmware, no target debugger, physical PLC, FTP port 21.
• Metrics: Successful RCE; nature of human intervention; time for final stage; API costs; payload derivation time; physical hardware damage.
• Comparison Boundary: No controlled comparison against humans working alone was performed; the researchers noted that a human working alone might have been faster and cheaper.

9. Results

• Successfully executed arbitrary ARM shellcode without authentication on the WAGO 750-831.
• The final stage required 8 hours and 32 minutes and cost $535.74.
• Created two network payloads in 12 minutes after solving target-specific buffer retention issues.
• Permanently bricked the PLC during C2 implant development due to an accidental write to flash memory.

10. Operational Implications

• The process currently requires expert assistance and high costs, making it no easier than traditional methods.
• Payload derivation after initial RCE is fast, and improving model capabilities may lower the cost of deployment to related targets in the future.
• Even defensive AI agents can cause physical and operational impacts if they malfunction when given write access to cyber-physical systems.

11. Success Conditions

• Access to the reference exploit, target firmware, and physical hardware.
• Human capability to supply firmware-specific disassembly and correct false hypotheses.
• An isolated lab environment capable of repeatedly observing network and memory behavior.

12. Constraints and Limitations

• This case study covers only a single vendor, a single CVE, and a single target, and cannot be generalized.
• There is no controlled comparison against humans alone or other AI models.
• The lack of a target debugger, combined with context window limits and false hypotheses, prolonged the trial-and-error process.
• The C2 implant was never completed, as the experiment ended due to hardware destruction.

13. Deployment and Operational Guidance

• Conduct OT exploit testing in a lab physically and network-isolated from production environments.
• Minimize network, memory, and firmware write permissions for AI agents, and establish clear stop conditions and human approval gates.
• Disable unnecessary FTP services on PLCs and block port 21 traffic from IT and external networks.
• Monitor for crashes, reboots, ICMP/UDP beacons, and configuration or firmware changes.

14. Required Evidence and Records

• Logs of models, versions, prompts, tools, and context windows.
• Firmware hashes, physical hardware models and versions, and network topologies.
• All FTP requests, crashes, uptimes, and ICMP/UDP packet captures.
• Human interventions, time spent, token usage, and API costs.
• Memory and flash states before and after hardware destruction, alongside recovery viability.

15. Facts / Inference / Hypothesis

Facts

• Forescout used AI assistance to port an existing RCE exploit for the WAGO 750-852 to the 750-831, executing arbitrary ARM shellcode via a pre-authentication FTP USER buffer overflow.
• The final RCE development stage took 8 hours and 32 minutes with an API cost of $535.74, spanning multiple days with human-provided disassembly context and correction instructions.
• The issue where the FTP process cleared the shellcode was resolved by omitting the CRLF terminator and changing the sequence to USER -> CWD.
• After overcoming this barrier, Claude created two payloads—an ICMP echo and a UDP packet sending the "PWNED" string—in 12 minutes.
• During C2 implant expansion, a payload wrote to a region mapped to flash memory, permanently damaging the WAGO 750-831.

Inference

• While AI strongly relies on expert support to solve target-specific initial exploit hurdles, it can accelerate payload derivation once code execution is established.
• OT defenders' assumption that difficult exploits represent low-reality threats must be re-evaluated as model capabilities and automation advance.

Hypothesis

• The suggestion that marginal costs for parallel ports to similar PLCs will decrease in the future is a projection and cannot be quantified based solely on this experiment.

16. MITRE ATT&CK Mapping

• Since this research did not observe active threat actor operations, no forced mapping is applied.

17. Unknowns and Further Research

• Reproducibility across other vendors, CPU architectures, and firmware versions.
• Strict time and cost comparisons against humans alone, other models, and environments with or without debuggers.
• The extent to which AI agent permission constraints can prevent physical hardware damage.

18. Impact on SOCs

In manufacturing, building automation, and water treatment environments, if legacy PLC FTP services remain reachable from IT/OT boundaries, organizations may be impacted by AI-assisted cross-model exploit porting. Organizations must map their assets, firmware, and service reachability, and ensure that AI-driven testing environments enforce physical safety, network isolation, write restrictions, and explicit stop conditions.

19. Summary by Role

• SOC Analysts: Monitor for abnormal FTP USER lengths, PLC crashes, ICMP/UDP beacons, and service reachability; do not dismiss difficult exploits from threat models.
• Administrators: Disable and isolate unnecessary FTP services on PLCs, apply firmware updates, restrict inbound traffic from external and IT networks, and establish safety boundaries for testing hardware.
• End Users: This is not an attack that general users handle directly. Promptly report any abnormal PLC stoppages or suspicious network activity to maintenance personnel.