AI Just Made Exploit Development Scary Easy for Hackers

Robert Moore · 2026-09-02

Here's something that should make every security professional sit up and take notice: researchers just used an AI chatbot to port a working exploit from one industrial device to another. Not in a lab simulation, not in theory, but on live hardware. Forescout Research's Vedere Labs team revealed that they used Anthropic's Claude to take a pre-authentication remote code execution (RCE) exploit originally built for one WAGO programmable logic controller (PLC) and successfully adapt it to work on a different PLC model. The result? Fully functional attacker-supplied ARM shellcode running on real equipment. ### What Exactly Happened? The vulnerability in question is CVE-2021-31886, a nasty stack-based buffer overflow found in the Nucleus FTP server's handling of the USER command. It's a pre-auth flaw, meaning an attacker doesn't need any credentials to trigger it. Just send a specially crafted FTP request, and you've got a foothold on the device. But here's the kicker: exploits aren't always portable. Different PLC models can have different memory layouts, different offsets, and different protections in place. Porting an exploit from one model to another used to require deep manual analysis and a solid understanding of both the hardware and the vulnerability. That's skilled work that takes time, patience, and expertise. Claude apparently handled that heavy lifting. The researchers guided the AI through the process, and it successfully adapted the exploit to work on the second PLC model. ### Why This Matters for Industrial Security Let's put this in perspective. PLCs are the workhorses of industrial automation. They control everything from assembly lines to power grids to water treatment plants. When we talk about critical infrastructure attacks, these are the devices at the center of the conversation. A few things make this development particularly concerning: - **Speed of attack development**: What used to take skilled reverse engineers weeks can now potentially be done in days or even hours with AI assistance. - **Lower barrier to entry**: You no longer need to be a low-level exploitation expert to port a known exploit. If you can guide an AI model, you can extend an attack surface. - **Pre-auth access**: The vulnerability requires no credentials, which makes it especially dangerous in segmented networks where authentication is often the first line of defense. Now, to be fair, this isn't about AI magically discovering new zero-days. CVE-2021-31886 has been known since 2021, and patches have been available for a while. The real story here is about how AI is compressing the timeline between vulnerability disclosure and weaponized exploits for different hardware variants. ### What Should Organizations Do? If you're running WAGO PLCs or any industrial control systems with Nucleus FTP servers, this should be a wake-up call. Here's a practical checklist: - Patch immediately. If you haven't applied updates for CVE-2021-31886 yet, stop reading and do that now. - Segment your OT networks. Don't let FTP traffic from untrusted zones reach your PLCs. - Monitor for anomalous FTP activity, especially failed or malformed USER commands. - Consider whether you really need FTP exposed on those devices at all. If not, disable it. ### The Bigger Picture This research isn't just about one vulnerability or one vendor. It's a glimpse into the near future of offensive security. AI models are getting better at understanding low-level code, memory layouts, and exploit techniques. They're becoming force multipliers for both defenders and attackers. The defensive side gets smarter detection and faster analysis. But the offensive side gets faster exploit development and easier porting across similar devices. That's a trade-off we're going to be wrestling with for years. > "The gap between discovering a vulnerability and having a working exploit is collapsing," one security researcher noted. "AI is accelerating that timeline in ways we haven't fully grappled with yet." For now, the best defense remains the basics: patch diligently, segment networks, monitor actively, and assume that known vulnerabilities will be exploited sooner than you think. The era of AI-assisted attacks on industrial infrastructure isn't coming. It's already here. Stay safe out there, and maybe give your OT team a heads-up about this one.