Forescout researchers used Claude Code to port a working pre-authentication exploit from one WAGO programmable logic controller to another. The AI-assisted process reached arbitrary code execution on a live 750-831 PLC, then a follow-on attempt to build a command-and-control implant wrote into flash-mapped memory and permanently bricked the device.
The Forescout Vedere Labs experiment targeted CVE-2021-31886 in the Nucleus FTP server. Forescout published its work on September 1, 2026, making a CERT@VDE advisory from November 16, 2021 newly relevant to AI-assisted exploit development. The final remote-code-execution stage took extensive researcher steering, 8 hours and 32 minutes, and $535.74 in API usage. This was authorized vendor research on one controller. Forescout did not report malicious use of the ported exploit or release it as an autonomous attack system.
An old flaw reaches hardware
CVE-2021-31886 exists because the FTP server fails to validate the length of a username in the USER command. An oversized value can overwrite the stack, redirect execution and run attacker-supplied ARM code before authentication. CERT@VDE’s WAGO advisory rates the flaw at CVSS 9.8 and says it can lead to denial of service or remote code execution.
Forescout began with an exploit it had already developed for a WAGO 750-852. Claude received that reference, the 750-831 firmware, a terminal, Ghidra, network utilities and access to a physical 750-831 running firmware V01.04.16. Researchers supplied disassembly context and repeatedly redirected the model after false leads.
“The final RCE development stage consumed $535.74 in API tokens during an 8-hour, 32-minute session for a single exploit on a single target,” Forescout wrote. The researchers added that a skilled human could currently have completed the initial port faster and more cheaply while keeping the controller alive.
Two commands preserve the payload
The reference exploit used an FTP USER command to trigger the overflow, followed by QUIT. That sequence crashed the 750-831 because its normal command-processing path erased 256 bytes of the attacker-controlled buffer before the injected shellcode could run.
Claude eventually traced the clearing operation after researchers pointed it toward the vulnerable copy operation and supplied additional decompilation context. It replaced QUIT with CWD and omitted the normal carriage-return and line-feed terminator. The altered sequence kept the session on a path that preserved the buffer long enough for execution to reach the shellcode.
Once that problem was solved, the model moved quickly. In 12 minutes it produced one payload that caused the PLC to send ICMP echo requests and another that sent a UDP packet containing PWNED. Forescout says the demonstrated exploit requires network access to the Nucleus FTP service on TCP port 21, requires no credentials and executes in the Ethernet receive callback.
Figure details
An oversized FTP USER command reaches the Nucleus FTP server on TCP port 21. The original USER-to-QUIT sequence clears the attacker-controlled buffer and crashes the controller. The ported USER-to-CWD sequence omits the normal CRLF terminator, preserving the buffer until arbitrary ARM code runs. From code execution, the successful research payloads sent ICMP or UDP traffic, while a later implant attempt wrote into flash-mapped memory and bricked the PLC.
The implant attempt destroyed hardware
After code execution, Forescout opened a separate Claude Opus 4.6 session to explore a more capable implant. The model generated and tested progressively more complex payloads while probing memory. One payload wrote to a region mapped to flash and rendered the PLC permanently unusable.
The test controller never recovered.
That failure is both a security result and a safety warning. A controller can fail while an exploit is being developed, tested or adapted. In an operational environment, a crash, reboot or damaged device may interrupt a physical process even when the intended payload never runs.
The result also limits the larger claim. The experiment required an existing exploit, firmware, tools, direct network access, physical hardware and sustained expert intervention. It demonstrates AI-assisted exploit adaptation on a constrained embedded target. It does not establish that current models can independently discover, port and deploy reliable PLC attacks at scale.
Public records conflict on scope
Forescout says the tested WAGO 750-831 ran firmware V01.04.16 and that the original advisory flagged it as vulnerable. The current CERT@VDE page lists 750-831/000-00x firmware through FW14 as affected. Those public version statements do not align cleanly, so operators should not infer a safe build from the apparent number alone.
The records conflict.
The CERT@VDE advisory lists the 750-829, 750-831/000-00x, 750-852, 750-880/0xx-xxx, 750-881, 750-882, 750-885/0xx-xxx, 750-889, 750-331 and 750-352/xxx-xxx as vulnerable to the full group of listed Nucleus flaws. It gives different affected firmware floors across models and directs readers to Siemens advisory SSA-044112 for the underlying component.
Confirm the controller’s complete order number, installed firmware and enabled services against current vendor guidance. Escalate the V01.04.16-versus-FW14 discrepancy to WAGO or CERT@VDE before classifying a 750-831 as outside the affected range. Forescout did not quantify deployed vulnerable units, internet exposure or successful attacks using its port.
Watch behavior before changing devices
Recognition begins with reachability. Inventory WAGO 750-series controllers and identify which systems accept FTP on TCP port 21. Review OT network telemetry for unexpected USER and CWD activity, oversized FTP arguments, sessions that omit normal terminators, repeated controller crashes or reboots, and ICMP or UDP traffic that is new for the device. Those behaviors reflect the published experiment; a match requires corroboration before attribution.
Preserve packet captures, controller events, firmware identity, uptime records and engineering-workstation activity before active testing. A malformed probe can stop or damage a controller. Coordinate containment with the process owner, establish a safe operating state and prepare a known-good replacement or recovery path before touching a suspected device.
Reduce unnecessary reachability to FTP, Telnet and web administration interfaces. Put controller access behind brokered, least-privilege remote access and enforce OT-zone rules that allow only the engineering systems and protocols each device needs. Keep AI-assisted firmware analysis and exploit validation inside an isolated lab with explicit stop conditions, reversible changes and human approval for hardware-affecting actions.
Verify the boundary from an authorized management segment. The expected result is that TCP port 21 is unreachable unless operations have a documented need for FTP, no unapproved host can send management commands to the controller, and the PLC produces only its established outbound traffic. Where FTP must remain, alert on oversized USER values, unusual USER-to-CWD sequences, unexplained resets and new ICMP or UDP destinations.
This experiment measured two costs at once: AI still needed expert help to port the exploit, while one unsafe memory decision destroyed the target. OT defenses should account for both trajectories before faster agents make either path cheaper.