AI-Assisted OT Exploitation Succeeds, but Remains Costly

Artificial Intelligence (AI) is getting closer to helping attackers exploit vulnerabilities in Operational Technology (OT), although current methods remain difficult and expensive, according to security researchers from Forescout.

In an experiment, the researchers ported a remote code execution (RCE) vulnerability from one Programmable Logic Controller (PLC) to another. The devices used closed-source software, but the attempt succeeded. The researchers triggered a Denial of Service (DoS) condition that crashed the device and then developed a working RCE capable of executing attacker-supplied ARM shellcode.

The result required substantial human involvement. The final RCE development stage used more than $500 in API usage, while an attempt to extend the exploit beyond the initial RCE ultimately bricked the PLC.

Forescout said the experiment showed that AI-assisted exploitation in OT is possible, but that the difficulty, cost and specialist expertise required are likely to make it less attractive than easier alternatives for now. That may limit interest from ordinary cybercriminals, but the report did not discuss nation-state attackers with significant resources. Industrial devices remain a prime target for those groups, and the researchers noted that spending more than $500 on API usage could be relatively minor for them. The article also cites Sandworm’s 2025 attack on Poland’s electricity suppliers.