# $536 and 8 Hours: AI Learns to Port a PLC Exploit

Claude successfully ported a security flaw between PLCs, but accidentally destroyed the hardware.

- **Source:** [Security Affairs](https://brifing.si/source/e6c4f5ec-3e1b-4152-a932-056243bd56eb)
- **Published:** 2026-09-02
- **Topic:** [Data & AI](https://brifing.si/c/data-ai)
- **Original article:** <https://securityaffairs.com/198296/hacking/536-and-8-hours-ai-learns-to-attack-a-different-plc.html>
- **On Brifing:** https://brifing.si/s/4358e913-d3ce-4e11-9632-4e8f6aa1d27c

## AI-Powered PLC Exploit Porting Experiment

Forescout researchers tested whether AI could port a security vulnerability from one PLC model to another. Using Claude Code, they attempted to transfer the CVE-2021-31886 exploit from WAGO 750-852 to 750-831. The AI worked with terminal access, Ghidra, and the physical device. The goal wasn't just porting the exploit but creating a more capable command-and-control implant on the constrained PLC environment.

## Challenges in the Process

Working with embedded firmware without source code or debugger proved difficult. Claude tested the live FTP server, analyzed firmware, and wrote Python scripts for analysis. It successfully crashed the PLC, confirming the buffer overflow vulnerability. The real challenge was converting this crash into executing attacker-controlled code, with FTP command processing overwriting the shellcode being a major obstacle.

## Breakthrough and Progress

Claude discovered that avoiding the normal FTP command completion path could preserve the shellcode. By omitting the CRLF terminator, the attacker-controlled buffer remained intact. After this solution, Claude created two working exploits in just 12 minutes: one sending ICMP pings and another transmitting 'PWNED' via UDP. Most time was spent solving the initial payload execution issue rather than creating the final exploits.

## Substantial Costs Involved

The final exploit development stage took 8 hours and 32 minutes, costing $535.74 in API fees. Researchers had to guide Claude through dead ends, provide disassembly details, and switch to a larger context model when needed. The session used 2.6k input and 1.3M output tokens. Majority of time was spent identifying the buffer preservation issue in FTP command processing.

## Unintended Hardware Destruction

After successful exploitation, researchers asked Claude to develop a full command-and-control implant. While probing the PLC's memory layout, one generated payload wrote to flash storage, permanently bricking the device. Claude wasn't instructed to cause damage - it was following directions but still destroyed hardware. This incident highlights potential risks of AI interacting with physical infrastructure.

## AI's Current Limitations

The experiment demonstrated AI's capability to port exploits but revealed the process remains fragile. Significant expert guidance, time, and costs are still required. AI isn't yet a tool for inexperienced attackers. However, AI's potential to reduce time and cost barriers is concerning, especially considering real incidents where internet-exposed PLCs were compromised without sophisticated exploits.

## Implications for Industrial Security

AI-assisted attacks may increase threats to industrial control systems, though autonomous complex exploit development isn't feasible yet. On defense, securing internet-exposed PLCs becomes more critical. AI's use in security research will shape both offensive and defensive strategies. The balance between AI's capabilities and its potential for unintended consequences requires careful consideration in industrial environments.

## Future Considerations

This experiment signals AI's expanding role in cybersecurity, but the hardware destruction serves as a serious warning. Less supervised AI agents operating on real-world systems could produce unpredictable outcomes. Security professionals must closely monitor AI's evolution in this space and develop appropriate defense mechanisms to address both intentional attacks and accidental damage scenarios.

## Sources covering this story

- https://securityaffairs.com/198296/hacking/536-and-8-hours-ai-learns-to-attack-a-different-plc.html — 

---

_Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._