Reported by 2 outlets

Timeline

1. original reporting

   Claude AI Develops Working RCE Exploit Against WAGO PLC With Researcher Assistance

   gbhackers.com · 41d ago · September 2nd, 2026

   Researchers have demonstrated that Anthropic’s Claude AI can assist in porting a remote code execution exploit between vulnerable models of WAGO programmable logic controllers (PLCs). However, this process requires significant human guidance, lengthy analysis sessions, and more than $500 in API usage. The experiment focused on CVE-2021-31886, a pre-authentication buffer overflow flaw in the Nucleus […] The post Claude AI Develops Working RCE Exploit Against WAGO PLC With Researcher Assistance appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .

2. update from cyberpress.org

   Claude AI Creates Pre-Auth RCE Exploit for WAGO PLC, Executing ARM Shellcode Without Credentials

   cyberpress.org · 41d ago · September 2nd, 2026

   A new demonstration shows that an AI-assisted workflow can port a pre-authentication remote code execution exploit to a vulnerable WAGO programmable logic controller, allowing arbitrary ARM shellcode to run without valid credentials. The research documented by Forescout shows meaningful progress in AI-enabled exploitation of operational technology but also reveals that the process remains expensive, error-prone, and heavily dependent on human reverse-engineering expertise. The experiment targeted CVE-2021-31886, a buffer-overflow vulnerability in the Nucleus FTP server used by certain embedded systems, including affected WAGO PLCs. Claude AI Creates Pre-Auth RCE Exploit for WAGO PLC The flaw occurs because the FTP service fails to adequately validate the length of a username supplied through the USER command. An attacker able to reach the vulnerable FTP service could use an oversized username to overwrite memory. In Forescout’s test, that capability resulted in arbitrary ARM shellcode executing on a WAGO 750-831 PLC running firmware version V01.04.16. The proof of concept required no FTP authentication because the vulnerable processing occurs before login. The successful payloads reportedly executed in the PLC’s Ethernet receive callback context, causing the device to generate outbound ICMP echo requests and UDP packets containing a test message. Forescout began with an existing exploit for a related WAGO 750-852 model, then tasked Claude Code with adapting it to the 750-831.