Security Also reported elsewhere 3 publishers 2 min read Published Sep 1, 2026, 6:59 AM PDT Updated Sep 2, 2026, 10:56 AM PDT

Porting a WAGO PLC exploit with Claude Code cost Forescout $500 and eight hours

Vedere Labs did get Claude Code to move a working exploit onto a second WAGO controller, and the price of doing it puts a measurable ceiling under the pitch that AI now writes OT exploits at machine speed.

The Watch · Security desk

Send a correction

Illustration accompanying Porting a WAGO PLC exploit with Claude Code cost Forescout $500 and eight hours — Generated illustration

What happened

Forescout's Vedere Labs got Anthropic's Claude to port a working PLC remote code execution exploit onto a second WAGO model, but only with heavy researcher oversight, hours of work and hundreds of dollars in API spend.
A follow-up session aimed at a command-and-control implant tested increasingly complex payloads until one wrote to flash-mapped memory and permanently bricked the test PLC.
Forescout put the final stage of remote code execution development alone at over $500 in API usage, spread across a single session that ran more than eight hours.

Why it matters

What it costs cost Anyone pricing attacker economics in OT now has a floor measured on real hardware: roughly $60 an hour in inference, plus a senior reverse engineer's time, per firmware family.
What it limits constraint Expert supervision remains the binding input on throughput, because the model needed a human to feed it firmware detail and reverse its wrong turns, so headcount sets the pace rather than API credit.
What's now possible capability The rapid second payload shows where scale would come from: understand one firmware family's memory behavior once, then mint variants for related devices at small marginal effort.
What it sets up precedent Forescout is asking readers to price a trend rather than this result, which makes the next port the test of whether required expert intervention is actually falling.

Next story · Build · Sep 24

Sonnet's output rate caps a $20 seat at 1.3 million tokens a month

One report1 publisher

More than $500 in API usage across a session of more than eight hours works out to roughly $60 an hour in inference spend ^[13]^[14], and that covers only the final stage of the port. A researcher sat with it the whole way, supplying firmware context and pulling the model off incorrect leads ^[7].

No new vulnerability came out of this. CVE-2021-31886 is a pre-authentication buffer overflow in the Nucleus FTP server that lets an unauthenticated attacker run arbitrary ARM shellcode, and Forescout already had a working exploit for the WAGO 750-852 ^[2]. What was being measured is the porting labor: moving that exploit to the related 750-831 ^[3]. Confirmation was fast. Given a terminal, Ghidra, reference files and the physical device ^[5], Claude Code combined live probing with static firmware analysis and produced a payload that crashed the controller ^[6]. Crashing a PLC is the cheap part. Controlled execution stalled until the team moved from Claude Sonnet 4.6 to Claude Opus 4.6 and instructed the model to ask for help whenever it was unsure about a firmware detail ^[8], after which it worked out why its injected code kept being erased before it could run ^[9]. Two working payloads followed within 12 minutes ^[10], about 2.5 percent of the eight-hour session ^[15].

For asset owners the follow-up session carries more weight than the port. Asked to build a command-and-control implant, the model tested progressively more complex payloads until one wrote into a region mapped to the PLC's flash memory and permanently bricked it ^[12]. An agent that escalates writes against a live controller will eventually take the asset out, which costs an intruder the foothold and hands the operator the loudest indicator available.

Forescout says plainly that the guiding researcher could have done the port without AI in less time, at lower cost, and with the PLC still alive, and argues the question worth tracking is what happens as the required expert intervention falls, because AI can lower the marginal cost of repeating the work across many related targets at once ^[16]. That is the claim to hold them to. On this run the compression landed on the step that was already cheap: generating more payloads after a human had understood the memory behavior. The experiment ran in the wake of the coordinated attacks on water-sector PLCs ^[4]. Against that backdrop, the figure to track per firmware family is how many times a human had to intervene.

What to watch

A second Forescout port against another WAGO model, and whether the $500 figure and the intervention count move.
Any water-sector PLC case where investigators find ported exploit code rather than reuse of the public 750-852 exploit.
Bricked controllers turning up as the residue of failed intrusions instead of clean code execution.

Clarity's read

What the record supports and how the coverage leans. The claims behind it follow.

Reality

Evidence50
Adoption12
Hype gap−10
Incentives55
Confidence55

Why these scores

Claim ledger

Ranked by verification strength, evidence, and original report placement.

[1]
Researchers at Forescout's Vedere Labs used Anthropic's Claude to port a working remote code execution exploit from one WAGO programmable logic controller to another, succeeding only after extensive researcher oversight, several hours of dedicated work, and hundreds of dollars in API costs.
Reported SupportedView cited source
[2]
The starting point was a previously developed exploit for the WAGO 750-852 PLC based on CVE-2021-31886, a pre-authentication buffer overflow in the Nucleus FTP server that allows an unauthenticated attacker to execute arbitrary ARM shellcode on the targeted PLC.
Reported SupportedView cited source
[3]
Forescout set out to adapt that exploit to a related but distinct model, the WAGO 750-831, and to see whether the AI could push the result further into a full command-and-control implant.
Reported SupportedView cited source
[4]
The experiment was conducted in the wake of the recent attacks targeting PLCs in the water sector.
Reported SupportedView cited source
[5]
The researchers used Claude Code, giving it access to a terminal, reference files, the reverse-engineering tool Ghidra, and the physical target device.
Reported SupportedView cited source
[6]
The AI confirmed the vulnerability through a mix of live probing and static firmware analysis before generating a payload that crashed the PLC.
Reported SupportedView cited source
[7]
Turning the crash into controlled code execution took far longer, and early attempts sent the AI chasing incorrect leads, requiring researchers to redirect its analysis and provide additional technical context.
Reported SupportedView cited source
[8]
Progress stalled until the team switched from Claude Sonnet 4.6 to Claude Opus 4.6 and instructed the model to ask for help whenever it was uncertain about a firmware detail.
Reported SupportedView cited source
[9]
The breakthrough came when the AI figured out why the injected code kept getting erased before it could run, then adjusted its approach to keep the payload intact.
Reported SupportedView cited source
[10]
Once that obstacle was cleared, Claude produced two separate working payloads within 12 minutes.
Reported SupportedView cited source
[11]
Forescout notes that the pattern of a difficult, time-consuming path to initial execution followed by rapid iteration afterward is what makes the cost of scaling this kind of work worth watching.
Reported SupportedView cited source
[12]
In a new session aimed at developing a command-and-control implant, Claude tested increasingly complex payloads, and one wrote to a region mapped to the PLC's flash memory, permanently bricking the device.
Reported SupportedView cited source
[13]
Forescout said the final stage of RCE development alone consumed over $500 in API usage across a session lasting more than eight hours.
Reported SupportedView cited source
[14]
The stated spend implies an inference burn rate of roughly $60 per hour of session time, as a lower bound.
Derived Supported
[15]
The 12 minutes in which two working payloads were produced is about 2.5 percent of the eight-hour session.
Derived Supported
[16]
Forescout wrote that the researcher guiding the AI could have achieved the initial RCE port without AI in less time and at lower cost while keeping the PLC alive, adding that the more important question is what happens as the amount of expert intervention required continues to fall, and that AI has the potential to reduce the marginal cost of doing this work across many related targets at once.
Reported Insufficient Source: Forescout Vedere Labs, quoted by SecurityWeekView cited source

Sources

3 independent publishers whose own reporting we read for this story.

securityaffairs.com
1 article · September 2, 2026
$536 and 8 Hours: AI Learns to Attack a Different PLC
securityweek.com
1 article · September 1, 2026
Experiment: Porting a PLC Exploit With AI Takes Hours and Hundreds of Dollars
thehackernews.com
2 articles · September 2, 2026
Researchers Use Claude to Port Pre-Auth RCE Exploit From One PLC Model to Another

Clarity analysis

How the coverage leans and what the record actually supports. Read the methodology

Perspective Coverage

How much of the coverage speaks to builders, operators and investors. It measures emphasis, not whether the story is right.

Builder

Read this as a capability log, not a threat bulletin. Claude Code got an unusually complete harness — terminal, Ghidra, reference files, the live controller — and still stalled, not on writing code but on understanding why its shellcode kept being erased before execution. What moved it was human context plus a bigger model: the team switched from Sonnet 4.6 to Opus 4.6 and told it to ask when firmware details were uncertain. SecurityWeek's telling of what followed is the part worth keeping: two working payloads in twelve minutes once the misconception broke. Hard part first, cheap part after.

Operator

For anyone responsible for controllers in the field, the unglamorous details carry the weight. The way in is still a 2021 pre-auth overflow in the Nucleus FTP server; the target was a sibling model of an already-exploited device, not an exotic one; and the destruction came from routine payload testing writing into flash and killing the PLC outright. Forescout's own caveat, as SecurityWeek relays it, is that a skilled human would have been quicker and would have left the device running. Unpatched 2021 firmware is the exposure here, not the model version doing the typing.

Investor

The only hard economics on offer: over $500 and over eight hours for the final stage of a single exploit port — about sixty dollars an hour of inference, and that figure excludes everything before the final stage. Forescout's argument is that today's bill matters less than how fast the required expert supervision shrinks, and nothing in this reporting measures that slope. Treat the number as a datapoint on the current unit economics of agentic security work, not as a trend line, and note that the same run also destroyed the hardware it was testing against.

Reality

Evidence, adoption, hype gap, incentives and confidence, each read independently from the current record on the scale shown beneath it. How these are measured.

Evidence50: 0100
One outlet, one lab's own account
Every figure that matters here — the $500, the eight hours, the twelve minutes, the bricked controller — comes from Forescout describing its own experiment, relayed by SecurityWeek. The underlying flaw is a public CVE and the method is described in enough detail to be argued with, which is more than most vendor research offers. What is missing is anyone outside Vedere Labs who has re-run the port or checked the meter.
Adoption12: 0100
A single bench run
What exists is one experiment, one controller model, one dead device at the end of it. Nothing in this reporting shows the technique used in a real intrusion, reproduced by a second team, or folded into anyone's tooling — and the water-sector PLC attacks that set the timing are not attributed to AI-assisted exploit work.
Hype gap−10: −100 understated0 aligned+100 overstated
Priced below the pitch
This reporting cuts against the machine-speed-exploit story rather than riding it: it says outright that the human would have been faster, cheaper and less destructive, and it puts a dollar figure on the alternative. The one place it reaches is forward-looking — the premise that expert babysitting keeps getting cheaper — and even that arrives phrased as a question rather than a finding.
Incentives55: 0100
Vendor lab, unflattering result
Vedere Labs is the research arm of a company that sells OT security, and an AI-writes-PLC-exploits headline lands well for that business — the framing alongside fresh water-sector PLC attacks is a choice, not a coincidence. What complicates the read is the shape of the result: hundreds of dollars, a wrecked controller, and an admission that a human would have done it better. Marketing rarely leads with that.
Confidence55: 0100
Concrete but unreplicated
Specific enough to believe about what happened on that bench; thin enough that we would not build a threat model on it. One publisher, one lab's telling, one device, and a cost figure that covers only the final stage of the work — with the earlier stages, and any second opinion, absent.

Topics and entities

Topics

AI Inference Cost Economics
Water Sector Cyberattacks
OT and ICS Security
Agentic Coding Tools
AI-Assisted Exploit Development
PLC Vulnerabilities