Researchers from Forescout Technologies used AI (artificial intelligence) to port a remote code execution exploit from one WAGO programmable logic controller (PLC) model to another, demonstrating that AI-assisted exploitation can extend to low-level operational technology environments. The exercise targeted a pre-authentication buffer overflow in the Nucleus FTP server and produced an exploit capable of executing attacker-supplied ARM shellcode on a live PLC. However, the researchers said the process required significant human involvement, including guiding the AI through failed approaches, providing disassembly context, and correcting false leads.
“AI has already lowered the barrier to vulnerability research and exploit development in higher-level software. This experiment suggests that the same progression is beginning to reach low-level embedded systems, although substantial barriers remain,” Amine Amri and Forescout Research – Vedere Labs wrote in a recent blog post. “As models become more capable and independent, the cost and expertise required to adapt exploits across related embedded targets could fall substantially. Once initial code execution was achieved, AI generated multiple working network payloads within minutes, suggesting that post-exploitation could become increasingly automated as models improve.”
The post added that the traditional assumption that attackers favor engineering protocols over complex PLC exploits may become less reliable as AI reduces the effort required for exploit development. RCE can provide attack paths and levels of device control that protocol abuse alone may not.
The research also highlighted current limitations and costs of using AI to develop PLC exploits. Forescout said the final remote code execution development stage took 8 hours and 32 minutes and consumed US$535.74 in API tokens for a single exploit against one target, while an attempt to extend the exploit into a command-and-control implant ultimately bricked the PLC. The researchers said these technical barriers and the specialist expertise required mean such attacks may currently be less attractive than easier alternatives, but warned that improving AI capabilities could substantially reduce cost and expertise needed to adapt exploits across embedded targets.
Earlier Forescout research already produced a working RCE exploit for the WAGO 750-852 PLC. It injected ARM shellcode that rewrote HTML on the PLC’s web interface to display an arbitrary message and worked with an initial USER command to trigger the buffer overflow and a subsequent QUIT command. That sequence becomes important later.
The researchers added that the exploit depended on target-specific parameters, including function addresses, offsets, and memory locations. “Our goal was to use AI to port the exploit to a similar, but not identical PLC model: the WAGO 750-831. Beyond simply porting the existing RCE, we also wanted to test whether AI could help extend it into a more capable command-and-control implant on the constrained PLC.”
Forescout detailed that AI-assisted exploit development process involved two main stages – confirming the vulnerability and writing the payload. Researchers interacted with Claude Code, which had access to a terminal, reference files, analysis tools such as Ghidra, and a live target PLC. The AI could directly use these tools, generate and test code, and request additional guidance when necessary.
During vulnerability confirmation, Claude Sonnet 4.6 initially identified a potential buffer overflow in the FTP command extraction loop that appeared distinct from the known CVE-2021-31886 vulnerability. Researchers set that finding aside and launched a new session focused on developing an exploit for the known vulnerability in a WAGO 750-831 PLC running at the specified target address.
Claude used two methods to validate the vulnerability: probing the PLC’s FTP service and performing static firmware analysis. The FTP banner confirmed that the target was running the relevant Nucleus FTP Server version, while Ghidra and AI-generated Python scripts were used to identify the operating system, architecture, firmware segments and vulnerable code. The process required multiple sessions and researcher guidance; an initial analysis produced an invalid exploit, but its findings helped a later session correctly map the relevant functions through binary searches and additional disassembly review.
The research showed that AI can help port a remote code execution (RCE) exploit from one PLC model to another by combining reverse-engineering tools such as Ghidra, AI-generated Python scripts and network tools. The AI was able to assist with vulnerability analysis, exploit development and testing against a live PLC without debugger access.
However, the process still required substantial expert guidance and resources. Developing the final RCE stage cost $535.74 in API usage, while efforts to extend the exploit ultimately bricked the PLC. The researchers noted that, under current conditions, an experienced researcher could potentially complete the initial exploit port faster and more cheaply without AI.
The larger concern is how declining requirements for human intervention could change the economics of exploit development. While sophisticated PLC exploitation still requires specialist knowledge and time, AI could eventually reduce those barriers and allow attackers to scale similar research across multiple embedded devices. This is particularly relevant as internet-facing PLCs already present operational risks, even without advanced RCE capabilities.
For critical infrastructure organizations, the research suggests vulnerabilities in OT devices should not be dismissed simply because exploitation is currently difficult or expensive. AI advances could make highly specialized attack paths more practical, including techniques that enable deeper lateral movement or granular manipulation of safety systems. This could require organizations to reassess the risk assigned to vulnerabilities that have traditionally been considered too complex or uneconomical for attackers to exploit.
Forescout called upon organizations to prioritize risk based on reachability, exploitability and process impact. OT vulnerabilities should be treated differently from conventional IT findings by considering the device’s role, network exposure, compensating controls and potential operational consequences. As AI reduces the effort required for exploit development, “hard to exploit” becomes a weaker reason for deprioritizing a vulnerable controller.
Organizations should reduce unnecessary exposure of OT devices by disabling or restricting high-risk services such as FTP, Telnet and web administration interfaces wherever possible. They should implement secure remote access for OT environments to replace flat VPN access and shared credentials with brokered, least-privilege access, reducing the paths available to an attacker seeking to reach vulnerable controllers.
Additionally, organizations should also monitor OT behavior for early signs of exploitation, including unusual protocol use, repeated crashes, unexpected outbound communication and changes in device behavior. AI-generated exploits may still produce noisy or unstable artifacts that defenders can use for detection. Incident response plans should be updated to include scenarios in which attackers rapidly adapt exploits across device models, abuse exposed management services, move laterally through engineering environments or cause device instability through failed exploitation.
Security teams should use AI defensively to accelerate firmware triage, advisory analysis, detection engineering and exposure reviews, while keeping human experts in the loop for safety-critical decisions. The same limitations observed in this research, including false leads and unsafe assumptions, also apply to defensive automation.
However, this recommendation reflects the current reality rather than necessarily representing the end state. The research required more than eight hours of iterative work and substantial researcher intervention to port one exploit to one additional target.
As model capabilities improve, both the time and human effort required are likely to fall. Defensive operations that depend on human approval for every action may struggle to keep pace if offensive systems become capable of running similar workflows across many targets in parallel.
