Yesterday Claude Refused to Read an Inert Script Over One Sentence. Today Researchers Used It to Port a Pre-Auth RCE to a Live PLC. The Guardrail Reads the Words, Not the Work.

Forescout Research's Vedere Labs published an experiment this week: they used Claude to port a working pre-authentication remote code execution exploit from one WAGO programmable logic controller to another, and executed attacker-supplied ARM shellcode on live hardware without credentials.

We have an unusual reason to write about this. Yesterday we published a test in which the same model family returned a hard refusal — stop_reason: refusal, empty content array, no explanation — when we asked it to analyze eight lines of inert VBScript that concatenated a string and wrote it to a log file. The only thing wrong with our sample was a comment an attacker had put there to trigger exactly that response.

So within twenty-four hours: refused on a benign script because of a sentence, and productive across an eight-hour session porting a 9.8 pre-auth RCE to industrial hardware.

That is not hypocrisy and it is not a gotcha. It is a precise, useful observation about where the boundary actually sits, and it is worth stating carefully because most people will reach for the wrong conclusion.

What Forescout Actually Did

The target is [CVE-2021-31886](https://analytics.dugganusa.com/api/v1/dredd/kev-gap?cve=CVE-2021-31886), a stack-based buffer overflow in the Nucleus FTP server's handling of the USER command. Siemens assigned it a CVSS of 9.8. It is reachable before authentication over TCP port 21. It was disclosed five years ago and it is patched.

Vedere Labs already had a working RCE for the WAGO 750-852. The experiment was to port that exploit to a WAGO 750-831 running firmware V01.04.16 — a different model from the same vendor, same bug class, different memory layout. They got there: arbitrary ARM shellcode executing on the device, no valid credentials required.

This is legitimate published security research on hardware the researchers own, against a five-year-old patched vulnerability, with the results disclosed publicly. That is what a red team does. Nothing about it needed to not happen.

The Numbers Are the Story, and They Cut Against the Panic

Read the cost line before you read anything else into this.

The final RCE development stage consumed $535.74 in API usage across an eight-hour, thirty-two-minute session. It required sustained steering from researchers who already understood embedded exploitation, already had a working exploit for a sibling device, and already knew what the answer was supposed to look like. And it bricked the test device.

Forescout's own conclusion is that AI can help adapt embedded exploits across similar OT targets while specialist expertise remains essential. We would put it more bluntly: the model did not find the bug, did not choose the target, did not know when it was wrong, and destroyed the hardware on the way to the result. It was a very expensive power tool in the hands of someone who could already do the job.

That is consistent with what we published in August about an autonomous agent that attacked 460 targets by itself and succeeded against three. The autonomy is real and the hit rate is not. Five hundred dollars and a bricked PLC to move an exploit between two models of the same product line is a data point against the story where anyone with a credit card is now an OT exploit developer.

We publish that half first because it is the half that gets left out.

Where the Boundary Actually Is

Now the part that is ours, because we have the receipt from yesterday.

Our refused sample was eight lines long. It made no network connection, executed nothing, and dropped no payload. It concatenated a hostname and wrote a line to a log file. It was, by construction, incapable of harm. It was refused because a Russia-aligned group figured out that putting a sentence about building a nuclear weapon inside a comment will make a triage model decline to read the file — a technique ESET named GuardBreaker and found in the wild against Ukrainian transport and energy targets.

Three defensive system prompts did not fix it. We tried.

Meanwhile, porting a pre-auth RCE to an industrial controller — real capability, real hardware, real shellcode — proceeded across eight and a half hours.

The difference is not the consequence of the work. It is the surface appearance of the request. One sample contained alarming words and did nothing. The other contained no alarming words and produced arbitrary code execution on a device class that runs building automation, water treatment and energy infrastructure.

A guardrail keyed to how a request reads rather than what it accomplishes has a specific failure mode, and it is not the one people worry about. It does not primarily let attackers through. It taxes defenders, because defenders are the ones who spend their day reading hostile text on purpose — malware, phishing kits, log lines full of injection attempts, files an adversary wrote specifically to be read by a machine.

An attacker can simply not write the scary sentence. A malware analyst does not get to choose what is in the sample.

Why We Are Not Calling for a Tighter Rule

The obvious response is to say the exploit work should have been refused too. We do not think that, and it is worth explaining why rather than gesturing at it.

Every technique in the Forescout paper is one a defender needs. Understanding whether a five-year-old Nucleus FTP bug is portable across a vendor's product line is precisely the question an asset owner running these controllers must answer, because the answer determines whether the patched model and the unpatched model at the far end of the plant share a fate. Vendors do not publish that analysis. Researchers do.

Tighten the boundary far enough to catch this and you catch the OT security team along with it — and OT security teams are already the most under-resourced defenders in the field, working on twenty-year-old hardware with no EDR, no patch window and frequently no budget.

The problem is not that the line is in the wrong place on a scale from permissive to strict. The problem is that it is being drawn on the wrong axis — reading the words in the artifact instead of the shape of the work being done with them.

What This Means If You Run OT

Practical, and mostly not about AI.

If you operate WAGO 750 series or anything else on the Nucleus RTOS, the exploitable surface here is an FTP server listening on port 21 before authentication. Find out whether that is reachable from anywhere a human or a compromised workstation can get to. On a lot of plant networks it is, because it always has been and nothing bad has happened yet.

CVE-2021-31886 is patched. The question worth asking is not whether you patched it in 2021 but whether every device of that family got the firmware, including the ones that were commissioned before the fix and have not been touched since. The Forescout result is specifically about portability across models — which is another way of saying the sibling device you did not inventory is the one that matters.

And treat the porting result as a statement about your fleet's homogeneity. If one exploit can be moved across two models with expert steering, then your exposure is not per-CVE, it is per-product-line.

What It Means If You Run AI-Assisted Triage

Assume your tooling can be made to decline. That is now a demonstrated adversary technique with a name, found in real malware, aimed at real infrastructure.

Log every refusal as an event and alert on it. A refusal on endpoint-sourced code is rare in normal operation, and an attacker who wants your automation to stop has to put something in the file to cause it — which makes the refusal itself an indicator. Route any refused sample to a human and to a static-analysis path that has no language model in it.

The failure mode to design against is not the model producing something harmful. It is the model producing nothing, and that nothing being read as nothing to see.

Credit and Honest Limits

The research, the porting result, the cost figure and the bricked device are all Forescout Research – Vedere Labs'. Read their write-up rather than our summary of it. The GuardBreaker technique and the UAC-0099 attribution are ESET's. Our contribution is one A/B test published yesterday and the observation that the two results sit badly together.

We build on Anthropic's models and say so publicly, which is a reason to be careful in both directions here — not to soften the refusal finding, and not to inflate the exploit finding into something the numbers do not support. Five hundred dollars, eight and a half hours, expert steering and a dead controller is a real capability and a modest one.

Confidence capped at 95 percent. The likeliest thing wrong in this post is the generalization from a single refusal test to a claim about where the boundary sits generally — one sample, one prompt, one model version, and the space of what triggers it is unmapped.

---

Every indicator in this post is in the feed. Free.

1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.

Get your free key → analytics.dugganusa.com/stix/register

---

Was this useful? Thirty seconds, no cookies, no tracking, no third parties, your address hashed and never stored. If the box below does not load, the same question lives at https://analytics.dugganusa.com/nps.html?post=yesterday-claude-refused-to-read-an-inert-script-over-one-sentence-today-researchers-used-it-to-por