AIBRIEF
Forescout had AI port a known exploit between factory floor controllers in 8.5 hours, and the catch is that it needed a human expert to finish the job.
Researchers at Forescout used AI assistance to port a known industrial-controller exploit from one model to another in 8.5 hours. The work required a human embedded-systems expert guiding the model at every step.
The target was a programmable logic controller, or PLC: the small industrial computer that runs assembly lines, refineries, power plants, and water utilities. Forescout asked frontier models to port an existing exploit from one PLC to a sibling model from the same vendor. Without source code or debugger access, the AI combined the reverse-engineering tool Ghidra, generated its own Python scripts, ran networking tools, and produced working exploit code tested against a live target.
The AI did not produce a clean, turnkey exploit, and the 8.5-hour run closed only with substantial human input. Forescout frames it as a planning signal: large language models have improved quickly on vulnerability research and exploit development over the past six months, and the same progression is starting to reach low-level embedded systems, even if substantial barriers remain.
Porting exploits across PLC models is a realistic attacker scenario, because vendors sometimes patch a reported flaw in one model without applying the same fix to siblings that share the vulnerable component, as Cybersecurity Dive notes. Secondary Coe Security coverage reads the experiment as the start of a new era in industrial cybersecurity. What stays unknown: how the same workflow would fare against a controller with no prior public exploit to start from.