Vulnerabilities & Exploits · IoT / OT Attack

Claude ported a WAGO PLC exploit across models

Forescout’s Vedere Labs said Claude helped port a working remote code execution exploit from the WAGO 750-852 to the related 750-831, but only after more than eight hours of work, heavy human supervision, and over $500 in API usage. The exploit was originally tied to CVE-2021-31886 in the WAGO Nucleus FTP server.

The model first used firmware analysis, Ghidra, and a live device to confirm the flaw, then had to be steered away from false leads until it figured out why injected code was being wiped before execution. Once that obstacle was solved, it produced working payloads quickly, showing how much the hard part is getting to first execution and how fast adaptation can move after that.

For OT teams, the point is not a new WAGO bug; it is that a known exploit can be reworked across sibling PLCs with less manual reverse engineering than before. If your control estate uses related device families, one understood model can shorten the path to others.

3 sources · Sep 2

CVE-2021-31886

NVD KEV

CVSS 9.8 CRITICAL: a vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All… EPSS 3% (88th percentile).

Timeline

Sep 2 Reported by The Hacker News
Sep 1 Reported by SecurityWeek

Sources

Sep 2 The Hacker News
Researchers Use Claude to Port Pre-Auth RCE Exploit From One PLC Model to Another
Researcher-guided Claude ported a pre-authentication RCE exploit to a WAGO 750-831 PLC, executing ARM shellcode on live hardware.
original
Sep 1 SecurityWeek
Experiment: Porting a PLC Exploit With AI Takes Hours and Hundreds of Dollars
Forescout researchers used Claude AI to port a remote code execution exploit between WAGO PLC models.
original
Sep 1 Cybersecurity Dive
Frontier AI helps exploit flaws in tests using key industrial devices
A report showed that Claude could help hackers develop attack strategies targeting PLCs used by water utilities and other industries.
original

Part of the PlainSec briefing for 2026-09-03

Every edition of this story: Claude ported a WAGO PLC exploit across models

More from today

Vulnerabilities & Exploits · IoT / OT AttackClaude ported a WAGO PLC exploit across modelsForescout’s Vedere Labs said Claude helped port a working remote code execution exploit from the WAGO 750-852 to the related 750-831, but only after more than eight hours of work, heavy human supervision, and over $500 in API usage. The exploit was originally tied to CVE-2021-31886 in the WAGO Nucleus FTP server.The model first used firmware analysis, Ghidra, and a live device to confirm the flaw, then had to be steered away from false leads until it figured out why injected code was being wiped before execution. Once that obstacle was solved, it produced working payloads quickly, showing how much the hard part is getting to first execution and how fast adaptation can move after that.For OT teams, the point is not a new WAGO bug; it is that a known exploit can be reworked across sibling PLCs with less manual reverse engineering than before. If your control estate uses related device families, one understood model can shorten the path to others.3 sources · Sep 2

CVE-2021-31886

NVD KEV

CVSS 9.8 CRITICAL: a vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All… EPSS 3% (88th percentile).

Timeline

Sep 2 Reported by The Hacker News

Sep 1 Reported by SecurityWeek

Sources

Sep 2 The Hacker News

Researchers Use Claude to Port Pre-Auth RCE Exploit From One PLC Model to Another

Researcher-guided Claude ported a pre-authentication RCE exploit to a WAGO 750-831 PLC, executing ARM shellcode on live hardware.

original

Sep 1 SecurityWeek

Experiment: Porting a PLC Exploit With AI Takes Hours and Hundreds of Dollars

Forescout researchers used Claude AI to port a remote code execution exploit between WAGO PLC models.

original

Sep 1 Cybersecurity Dive

Frontier AI helps exploit flaws in tests using key industrial devices

A report showed that Claude could help hackers develop attack strategies targeting PLCs used by water utilities and other industries.

original

Part of the PlainSec briefing for 2026-09-03Every edition of this story: Claude ported a WAGO PLC exploit across modelsMore from today

Citrix NetScaler Gateway flaw hits KEV list

Wordfence sees mass WordPress shell drops

Exchange servers leave mailboxes open to hijack