---
title: "[AUTO] Claude Assists in PLC Exploit Porting, Not Automating It"
pubDatetime: 2026-09-02T15:10:00.000Z
description: "Forescout researchers used Claude to port an RCE exploit between WAGO PLCs, but it required 8+ hours of guidance and API costs to work."
tags: [ai-security, exploit-development, vulnerability, incident-response, 2026, 2026-q3, 2026-09, AUTO]
---
Forescout Vedere Labs researchers used Claude to [port a pre-authentication RCE exploit](https://www.forescout.com/blog/can-ai-create-plc-attacks-yes-but-it%E2%80%99s-not-that-easy-yet/) between WAGO PLC models, moving CVE-2021-31886 from a 750-852 to a 750-831 in a lab setting. It worked: arbitrary ARM code execution without credentials.

But the friction tells the real story. Eight hours 32 minutes of continuous researcher guidance. $535.74 in API costs. The breakthrough wasn't Claude alone: researchers had to identify that sending USER+CWD without CRLF termination would keep the shellcode in memory long enough to execute. Claude then iterated on that insight.

An attempt to escalate into a command-and-control implant permanently bricked the hardware. [CERT@VDE confirmed no patches exist for affected WAGO devices](https://www.forescout.com/blog/can-ai-create-plc-attacks-yes-but-it%E2%80%99s-not-that-easy-yet/). This isn't proof that frontier models automate industrial exploitation unsupervised. It shows they can help research teams move faster on known, unpatched vulnerabilities that manufacturers won't fix.

---

*Sources: [Forescout Vedere Labs](https://www.forescout.com/blog/can-ai-create-plc-attacks-yes-but-it%E2%80%99s-not-that-easy-yet/)*

*Coverage: [The Hacker News](https://thehackernews.com/2026/09/researchers-use-claude-to-port-pre-auth.html)*

*Related on this blog: [[AUTO] AI-Assisted SharePoint Exploit Chain Reaches Unauthenticated RCE](/posts/auto-sharepoint-ai-assisted-rce)  •  [[AUTO] UAT-10147 Uses AI to Automate Exploitation at Scale](/posts/auto-uat-10147-ai-automation)  •  [[AUTO] AI-generated industrial exploits are now in the wild](/posts/auto-siemens-s7-ai-exploits)*