Claroty’s Team82 research team reproduced three previously disclosed vulnerabilities in Danfoss AK-SM 800A refrigeration controllers using an artificial intelligence (AI) coding agent, chaining two of them to achieve root-level command execution on a laboratory device in approximately 28 minutes at an AI usage cost of about US$6. The report detailed that the experiment used Anthropic’s Claude Sonnet 4.6 in medium reasoning mode through the Cursor AI-native code editor, with publicly available firmware, vulnerability identifiers and analysis tools. The team found that the agent initially reproduced two vulnerabilities, CVE-2025-41451 and CVE-2025-41452, but required researcher guidance and Ghidra reverse-engineering integration to correctly reproduce the authentication bypass vulnerability CVE-2025-41450 and demonstrate root access.
“The agent initially reproduced two vulnerabilities (CVE-2025-41451 and CVE-2025-41452) but failed to correctly analyze the authentication bypass (CVE-2025-41450), confidently pursuing an incorrect approach,” Amir Zaltzman, vulnerability researcher, wrote in a Team82 blog post last week. “We redirected the investigation and provided a Ghidra Model Context Protocol (MPC) integration for targeted decompilation and cross-reference analysis of the controller’s 67 MB main application binary. Ghidra is a reverse-engineering platform.”
He noted that with the right tools and guidance, the agent reproduced the bypass and chained it with command injection to demonstrate root access. “The researcher remained essential, but hands-on analysis was substantially reduced. Human expertise was needed to recognize incorrect results, ask the right questions, and validate the outcome. Once equipped with the appropriate tools and direction, the agent automated much of the subsequent analysis and vulnerability reproduction.”
Team82 said the findings highlight how AI coding tools could lower the time, cost and expertise required to reproduce known vulnerabilities affecting operational technology (OT) systems. Searches using Censys and Shodan identified thousands of potentially exposed devices, underscoring the risks associated with internet-facing industrial equipment that attackers may reach without first compromising an organization’s internal network.
The research team cautioned that the experiment did not demonstrate autonomous vulnerability discovery from scratch, as it relied on public vulnerability disclosures and human intervention to correct the AI agent’s initial errors. However, the combination of publicly accessible firmware, disclosed vulnerabilities, and limited-cost AI-assisted analysis could shorten the interval between vulnerability disclosure and practical exploit reproduction, increasing security concerns for organizations operating refrigeration controllers and other industrial systems.
Using Anthropic’s Claude Sonnet 4.6 in medium reasoning mode through the Cursor AI-native code editor, we reproduced the vulnerabilities and chained two of them to achieve root-level command execution on a lab device. The work took about 28 minutes from initial analysis to a working exploit, at a cost of roughly $6 in AI usage.
The firmware was downloaded directly from Danfoss’s public website, with no registration or encryption barrier to overcome. The starting point was public CVE identifiers, vulnerability classifications, the firmware package and analysis tools, with no original research or private analysis. Quick searches on Censys and Shodan revealed thousands of potentially exposed devices, which highlights the scale of the attack surface. Internet-facing systems may be reachable without an attacker first breaching an organization’s internal network.
Zaltzman wrote that the cyberattacks on supermarket refrigeration systems in France show how damage to industrial equipment can quickly become food waste and financial loss. They also show how a single insecure internet-facing asset can give an attacker a route to inflict real damage on critical infrastructure.
“The precise attack path used in the France attacks remains unconfirmed; we know that Danfoss refrigeration systems were targeted,” he added. “Earlier this year we published research that provides some detail on authentication bypass and operating-system command execution vulnerabilities in Danfoss AK-SM 800A refrigeration controllers.”
Zaltzman said Anthropic’s recent analysis of GLM-5.3 raises a broader question: how advanced cyber capabilities are reaching beyond the most powerful proprietary models. “Our experiment examines the practical implications for OT security: even a relatively modest AI coding model, paired with publicly available vulnerability information, accessible firmware, and analysis tools, can reproduce known vulnerabilities in minutes for just a few dollars.”
He added, “This was not an autonomous vulnerability discovery from scratch. Public CVEs provided the starting point, and researcher guidance helped overcome the agent’s initial failure. Nevertheless, the combination of low cost, minimal time, limited human intervention, and internet-exposed devices makes reproducing known vulnerabilities increasingly practical for real-world attackers.”
