Summary
- AI-assisted research successfully adapted a remote-code-execution exploit from one WAGO PLC model to another.
- The final development stage lasted more than eight hours, cost $535.74 in API usage, and required extensive expert guidance.
- An attempt to extend the result further permanently damaged the test PLC, exposing the operational limits of autonomous work on physical systems.
Artificial intelligence can help adapt low-level exploits between industrial controllers, but new research from Forescout suggests the process remains expensive, error-prone, and heavily dependent on human expertise.
Researchers at Forescout’s Vedere Labs used Anthropic models to port an existing remote-code-execution exploit from a WAGO 750-852 programmable logic controller to the related WAGO 750-831. The work took place in a controlled research environment against equipment owned by the researchers and did not involve a real-world intrusion.
The experiment is notable because it moved beyond the higher-level application software that dominates most AI vulnerability research. Programmable logic controllers run specialised embedded systems, often without the debugging access or source code that makes conventional software analysis easier.
Forescout’s starting point was CVE-2021-31886, a previously known vulnerability affecting the Nucleus FTP software used by certain WAGO controllers. Researchers already possessed a working exploit for one controller and asked the AI system to determine the target-specific changes needed to make it work against another affected model.
The AI eventually helped produce working code execution, but the route was far from autonomous. Forescout said researchers repeatedly had to steer the model away from false leads, provide additional reverse-engineering context, and intervene when its assumptions about the target were wrong.
The final remote-code-execution development phase consumed $535.74 in API usage and ran for eight hours and 32 minutes across several days of research. Forescout argues that an experienced human researcher might currently have completed the work more cheaply and quickly without AI assistance.
The experiment became more consequential when the team tried to move beyond initial code execution. During work on a more capable implant, one AI-generated payload wrote to a sensitive memory region and permanently bricked the PLC.
That failure is as important as the successful exploit port. Mistakes in ordinary software research can crash an application or waste researcher time. The same mistake against operational technology can take a physical device out of service, with implications that become considerably more serious in an industrial environment.
Forescout does not present the experiment as evidence that autonomous AI systems are already carrying out sophisticated attacks against industrial control systems. The research instead measures how much specialist work can currently be delegated and where the technology still struggles.
The answer remains mixed. AI could use reverse-engineering tools, generate analysis scripts, test hypotheses, and produce working payloads once the difficult target-specific problem had been solved. It was much less reliable when reasoning through unfamiliar embedded behaviour without expert correction.
That leaves a significant barrier to practical abuse today, particularly when attackers can often achieve operational disruption through exposed remote access, stolen credentials, poorly segmented networks, or legitimate engineering protocols without developing a custom binary exploit.
The longer-term concern is the marginal cost of repeating the work. If models become better at solving target-specific reverse-engineering problems, the economics of adapting a known vulnerability across families of similar embedded devices could change. Exploit paths previously regarded as too specialised or expensive may become viable against a wider population of equipment.
Industrial environments make that trajectory harder to dismiss. PLCs and other operational technology frequently remain deployed for long periods, operate inside systems where downtime is costly, and can have direct physical consequences when they fail. The research also shows that giving increasingly autonomous systems direct access to live equipment creates risks even when the AI is being used by an authorised researcher rather than an attacker.
For now, the experiment documents capability rather than an active threat campaign. It also provides a useful counterweight to claims that frontier models have already eliminated the specialist knowledge required for low-level industrial exploitation: the model succeeded, but only after substantial human involvement, significant cost, repeated failure, and the destruction of its final test device.
