AI Tool Helps Researchers Transfer PLC Exploit Across Models, Demonstrating New Threat Vector

Security researchers at Forescout Research's Vedere Labs have shown that Anthropic's Claude language model can be used to adapt a working pre‑authentication remote code execution (RCE) exploit from one WAGO programmable logic controller (PLC) to a different model, allowing them to run attacker‑supplied ARM shellcode on live hardware in a controlled test environment.

Programmable logic controllers are the backbone of modern industrial automation, managing processes in factories, utilities, and infrastructure. WAGO, a German manufacturer, supplies a range of PLCs that are widely deployed in sectors ranging from automotive assembly to water treatment. Because these devices often run continuously and are connected to broader networks, vulnerabilities that can be triggered without prior authentication pose a serious risk to operational continuity.

The exploit in question bypasses the PLC's authentication mechanisms, granting the attacker the ability to execute arbitrary code directly on the device's ARM‑based processor. By demonstrating the exploit on two distinct WAGO models, the researchers proved that the vulnerability is not confined to a single hardware revision, raising concerns that other variants could be similarly susceptible. Successful execution of custom shellcode on operational hardware underscores the practical danger of such flaws in real‑world settings.

Claude's involvement was central to the research. The team fed the model detailed technical specifications and code snippets from the original exploit, and Claude generated adapted payloads and suggested modifications needed to target the second PLC model. This AI‑assisted approach accelerated the reverse‑engineering process, highlighting how large language models can both aid defenders in identifying weaknesses and, potentially, lower the barrier for malicious actors to weaponize them.

Following the disclosure, WAGO has acknowledged the findings and indicated that patches are being prepared for affected product lines. Industry observers note that the episode illustrates the growing convergence of AI tools and cybersecurity research, prompting calls for manufacturers to adopt more rigorous security testing that includes AI‑driven analysis. As the line between defensive and offensive capabilities continues to blur, experts warn that proactive vulnerability management will become increasingly essential to safeguard critical infrastructure.