AI Tool Claude Helps Researchers Adapt RCE Exploit for WAGO Industrial Controllers

Researchers have shown that Anthropic's Claude artificial‑intelligence system can be leveraged to transfer a remote‑code‑execution (RCE) exploit from one vulnerable WAGO programmable logic controller (PLC) model to another, underscoring both the potential and the limits of AI assistance in cybersecurity research.

The demonstration, originally reported by the GBHackers community, involved a step‑by‑step collaboration between human analysts and Claude. While the AI was capable of generating code snippets, suggesting payload modifications, and outlining testing procedures, the researchers emphasized that the process demanded extensive human oversight, prolonged analysis sessions, and iterative refinement.

WAGO PLCs are widely deployed in manufacturing, energy, and infrastructure environments to control machinery and processes. Vulnerabilities that permit remote code execution can allow an attacker to take direct control of physical equipment, raising safety and operational concerns. The exploit in question targets a known flaw in the firmware of certain WAGO models, a weakness that has been documented in previous security advisories.

In the study, the team first reproduced the original exploit on a legacy WAGO device. They then tasked Claude with translating the exploit logic to a newer, but similarly vulnerable, model. Claude produced a draft of the modified payload and highlighted sections of the firmware that required alteration. Researchers had to validate each suggestion, manually test the code on hardware, and correct inaccuracies in the AI's output.

The authors of the demonstration caution that Claude’s contributions, while valuable, are not a substitute for expert knowledge. "The AI can accelerate certain repetitive tasks, such as pattern matching or code restructuring, but it lacks the contextual awareness to guarantee safety or correctness," one researcher noted. The collaboration nonetheless illustrates how generative AI may become a tool in the security analyst's toolkit, especially for tasks that involve large codebases or intricate protocol details.

Industry observers see the experiment as a double‑edged sword. On one hand, AI‑assisted vulnerability research could speed up the discovery and patching of critical flaws, benefitting manufacturers and operators. On the other, the same technology could be misused by malicious actors seeking to streamline exploit development. The balance between these outcomes will likely shape future policy discussions around AI governance in cybersecurity.

Anthropic, the creator of Claude, has not commented on the specific use case but maintains that its models are intended for constructive applications and that responsible usage guidelines are in place. Meanwhile, WAGO has issued advisories urging customers to apply available firmware updates and to follow best practices for network segmentation to mitigate the risk of remote attacks.

The experiment adds to a growing body of evidence that AI can play a supportive role in complex technical domains, provided that human expertise remains the decisive factor. As AI capabilities continue to evolve, both defenders and attackers may increasingly turn to such tools, prompting a reassessment of how security research is conducted and how defenses are structured.