From Crash to Code Execution: Inside an AI-Assisted PLC Exploit Port
About This Session
Forescout’s Vedere Labs set out to answer a practical question: how effectively can today’s AI tools help an experienced researcher adapt a working exploit from one industrial device to another?
This technical session walks through the team’s experiment porting a remote code execution exploit for CVE-2021-31886 from a WAGO 750-852 PLC to the related WAGO 750-831. The presentation will examine the research workflow, including the use of Claude Code, Ghidra, firmware analysis, live probing, and direct access to the physical PLC.
Rather than focusing on AI hype, the session will explore what actually happened during the experiment: where the AI identified useful paths, where it pursued incorrect assumptions, what technical context researchers had to provide, and how the team progressed from simply crashing the PLC to achieving controlled code execution.
The session will also examine the subsequent attempt to extend the exploit into a command-and-control implant, which ultimately resulted in a bricked device, along with the time, cost, and level of human expertise required throughout the process.
Attendees will leave with a clearer understanding of the current capabilities and limitations of AI-assisted exploit development and what increasing automation of this work could mean for industrial device manufacturers, OT security researchers, and defenders as similar techniques become easier to scale across related devices.
This technical session walks through the team’s experiment porting a remote code execution exploit for CVE-2021-31886 from a WAGO 750-852 PLC to the related WAGO 750-831. The presentation will examine the research workflow, including the use of Claude Code, Ghidra, firmware analysis, live probing, and direct access to the physical PLC.
Rather than focusing on AI hype, the session will explore what actually happened during the experiment: where the AI identified useful paths, where it pursued incorrect assumptions, what technical context researchers had to provide, and how the team progressed from simply crashing the PLC to achieving controlled code execution.
The session will also examine the subsequent attempt to extend the exploit into a command-and-control implant, which ultimately resulted in a bricked device, along with the time, cost, and level of human expertise required throughout the process.
Attendees will leave with a clearer understanding of the current capabilities and limitations of AI-assisted exploit development and what increasing automation of this work could mean for industrial device manufacturers, OT security researchers, and defenders as similar techniques become easier to scale across related devices.
Speaker
Sai Molige
Senior Manager, Threat Hunting - Forescout Technologies
Sai Molige, known as “Cyb3rhawk,” is the Senior Manager of Threat Hunting at Forescout Technologies, overseeing cross-team research and operations. With experience at Comcast and Snap Inc., he actively participates in conferences and educational programs. Sai aims to make detection engineering, threat intelligence, and hunting accessible to practitioners of all skill levels. He addresses the common challenge of unstructured threat hunting, which often feels like random searching. His LAYER approach seeks to understand the “why” behind hunting, connecting high-level concepts with practical methods to create repeatable and effective workflows. Sai emphasizes that hunting is not just about finding new threats but understanding the nature of threats and their environment.