Forescout Shows AI Can Repurpose PLC Exploit in Hours, Costing Only Hundreds

Researchers at cybersecurity firm Forescout demonstrated that a large language model can accelerate the adaptation of a remote code execution exploit for programmable logic controllers, completing the task in a matter of hours and at a cost measured in a few hundred dollars.

The team focused on two different models from the WAGO line of industrial controllers, a platform commonly used in manufacturing and infrastructure. By feeding the Claude AI model with the original exploit code and technical specifications of the target devices, the researchers were able to generate a functional variant that could execute arbitrary commands on the new hardware.

According to the experiment, the AI‑assisted workflow reduced the manual effort traditionally required for such reverse‑engineering tasks. While a seasoned analyst might spend days or weeks dissecting firmware, mapping memory layouts, and crafting payloads, the Claude‑driven process produced a working exploit in roughly eight hours of active work, with the AI service fees amounting to a few hundred dollars.

The demonstration underscores a growing concern among security professionals: artificial intelligence tools are becoming capable of lowering the barrier to weaponizing vulnerabilities in industrial control systems. PLCs have historically been considered “air‑gapped” or otherwise insulated from conventional cyber threats, but the ease of repurposing exploits could broaden the pool of potential attackers.

Forescout’s findings also highlight the importance of proactive vulnerability management in the OT space. Vendors are urged to adopt secure development practices, conduct regular code audits, and provide timely patches. Meanwhile, organizations operating critical infrastructure are advised to monitor for anomalous network activity and to segment control‑system traffic from corporate IT networks.

Looking ahead, the researchers suggest that the security community should treat AI‑assisted exploit development as a new threat vector, prompting updates to threat‑modeling frameworks and investment in defensive tools that can detect AI‑generated malicious code. The experiment serves as a reminder that as AI capabilities expand, so too must the strategies used to safeguard the systems that keep modern industry running.