Executive Summary
Forescout researchers used Claude to port a working pre-auth RCE exploit for an old FTP flaw from one WAGO PLC model to another, running code on live hardware.
What Happened
Forescout Research - Vedere Labs said it used Anthropic's Claude to port a working pre-authentication remote code execution (RCE) exploit from one WAGO programmable logic controller (PLC) to another, executing attacker-supplied ARM shellcode on live hardware. The exploit targets CVE-2021-31886, a stack-based buffer overflow in the Nucleus FTP server's handling of the USER command
Affected Products
- WAGO PLCs
- Anthropic Claude
Vulnerability / Attack Technique
AI-assisted exploit adaptation (research)
Technical Mechanism
As reported, the model helped adapt an existing exploit to a different device.
AI Security Category
AI-assisted attack
Part of the AI-Assisted Attacks topic.
RealGround Analysis
AI lowers the cost of adapting OT exploits. RealGround analysis: old unpatched PLC flaws become more dangerous.
Recommended Controls
- Patch or isolate PLCs
- Disable unused PLC services such as FTP
Related RealGround Service
AI Red Teaming · or start with the free AI Agent Security Scanner.
Sources
thehackernews.com: https://thehackernews.com/2026/09/researchers-use-claude-to-port-pre-auth.html
Summary and analysis written by RealGround from the source above; last updated 2026-10-18.