AI Used to Port PLC Exploit Raises Concerns Over Industrial Security

Researchers at Forescout’s Vedere Labs successfully ported a remote code execution (RCE) exploit between two WAGO PLC models, specifically targeting CVE-2021-31886, a pre-authentication buffer overflow in the Nucleus FTP server. The experiment took over eight hours and cost approximately $535 in API tokens, highlighting the significant human oversight still required despite AI assistance. Initial attempts at exploit development faced challenges, including incorrect hypotheses and dead ends, but after switching to Claude Opus 4.6 and refining prompts, the AI produced working payloads rapidly. The experiment underscores the potential for AI to automate post-exploitation activities, raising alarms about the accessibility of such techniques for malicious actors. As AI-assisted exploit development improves, the risk to industrial systems could increase significantly.

Key Points: • AI successfully ported an RCE exploit targeting WAGO PLCs, specifically CVE-2021-31886. • The experiment required over eight hours and $535 in API costs, emphasizing human oversight. • AI's ability to automate post-exploitation could make attacks on industrial systems more accessible.