Claude Ports WAGO PLC RCE Exploit in 8 Hours for $500 With Heavy Oversight

Researchers gave Claude Code access to a terminal, Ghidra, firmware, and the live 750-831 target. The model confirmed the Nucleus FTP flaw via probing and static analysis, then generated a crashing payload. Controlled execution required repeated researcher redirection after the model pursued incorrect leads on memory layout and payload persistence. Switching to Claude Opus 4.6 and instructing the model to query for uncertain firmware details produced the breakthrough: the AI identified why injected code was being erased and adjusted the write sequence. Two working payloads followed within 12 minutes. A subsequent command-and-control implant attempt wrote to flash memory and bricked the device. The experiment occurred against documented water-sector PLC incidents where similar unauthenticated RCE paths were observed. Evidence shows initial RCE porting remains expert-intensive while post-execution iteration accelerates rapidly. This pattern indicates the marginal cost of scaling across related firmware families, not single-target effort, is the metric to track. Procurement and incident records already show OT operators exposing WAGO and Siemens devices with limited segmentation. Continued decline in required intervention will lower the barrier for parallel targeting of multiple models rather than one-off research.