Researchers Use Claude to Port Pre-Auth RCE Exploit From One PLC Model to Another
- ID
- 20593
- Status
- summarized
- Published
- 02 Sep 2026, 3:47 PM
- Fetched
- 02 Sep 2026, 3:52 PM
- Provider
- The Hacker News
- Category
- security
- Original URL
- https://thehackernews.com/2026/09/researchers-use-claude-to-port-pre-auth.html
- Source URL
- https://feeds.feedburner.com/TheHackersNews
Summary
- Score
- 6.5
- Created
- 02 Sep 2026, 3:53 PM
- Tags
- Audience
- developersai_ml_learnersai_agent_users
What happened
Forescout's Vedere Labs used Claude (Sonnet 4.6, then Opus 4.6) via Claude Code with Ghidra and terminal access to port a pre-auth RCE exploit (CVE-2021-31886, CVSS 9.8) from a WAGO 750-852 PLC to a WAGO 750-831 running firmware V01.04.16. The port cost $535.74 in API spend over 8h32m, required sustained human steering, and a follow-up C2 session permanently bricked the PLC by writing to flash-mapped memory. Forescout itself noted a skilled researcher could have done it faster, cheaper, and without destroying the hardware.
Why it matters
This is a concrete cost-and-limitation data point for anyone evaluating AI agents on hard reverse-engineering tasks: $535.74 and 8.5 hours for one exploit port, with a costly destructive failure on the follow-up. If you are budgeting AI agent usage for complex technical work, expect significant human-in-the-loop steering and factor in the risk of irreversible mistakes on live hardware or production systems.
Discussion angle
The honest counterfactual from the researchers themselves — manual work would have been faster, cheaper, and non-destructive — raises the question: when does AI-assisted security work actually pay off versus when is it a more expensive, riskier path to the same outcome?