Forescout Research (Vedere Labs) has successfully utilized Anthropic's Claude model to port a pre-authentication remote code execution (RCE) exploit between different WAGO programmable logic controllers (PLCs). The exploit targets CVE-2021-31886, a critical stack-based buffer overflow in the Nucleus FTP server. This research demonstrates how AI agents with access to reverse-engineering tools like Ghidra can adapt complex exploit code for new hardware targets, though the process still requires significant researcher steering and API costs.
During the experimentation, the AI adapted shellcode to bypass specific firmware constraints, eventually establishing code execution to send network packets. However, the study also highlighted the risks of AI-driven automation, as an attempt to develop a command-and-control (C2) implant resulted in permanently bricking a PLC. Federal agencies like CISA and the FBI have recently warned that AI-generated scripts are increasingly being used to target industrial control systems (ICS), lowering the barrier for entry for threat actors.
Top comments (0)