AI Agent Rebuilds Danfoss Exploits in 28 Minutes: What It Means for OT
Claroty's Team82 used an AI coding agent to reproduce three known vulnerabilities in Danfoss AK-SM 800A controllers in about 28 minutes for roughly $6. The case shows how AI shortens the time between a CVE disclosure and a working exploit.
According to Industrial Cyber on October 19, 2026, Claroty's Team82 used an AI coding agent to reproduce three previously disclosed vulnerabilities in Danfoss AK-SM 800A refrigeration controllers. Two of them were chained to achieve root-level command execution on a lab device. According to the article, Team82's original post was published the week before.
How the experiment was run
The agent was Anthropic's Claude Sonnet 4.6, set to medium reasoning and used through the Cursor editor. The inputs were entirely public: firmware downloaded from Danfoss's website with no registration or encryption, the CVE identifiers, the vulnerability classifications and a few analysis tools. The work took about 28 minutes and cost roughly $6 in AI usage.
Where the agent needed help
The agent reproduced CVE-2025-41451 and CVE-2025-41452 on its own. On the authentication bypass, CVE-2025-41450, it went wrong, confidently pursuing an incorrect approach. The researchers redirected it and gave it a Model Context Protocol integration with Ghidra, which enabled targeted decompilation and cross-reference analysis in the controller's 67 MB main application binary. With this support the agent reproduced the bypass and chained it with the command injection to gain root privileges.
According to researcher Amir Zaltzman, human expertise is still needed to recognize wrong results, ask the right questions and validate the outcome, even though manual effort was substantially reduced.
Limits acknowledged by Team82
Team82 stresses that this was not autonomous vulnerability discovery from scratch. The experiment relied on public disclosures and on humans correcting the agent's mistakes. The concern lies elsewhere: AI lowers the time, cost and skill needed to turn a disclosed CVE into a working exploit, shrinking the window for patching or isolating devices.
Exposure
Searches on Censys and Shodan identified thousands of potentially exposed devices. The exact number is not given in the part of the article I reviewed, and the status of Danfoss patches is not confirmed either, so it is best to check the vendor's advisories directly.
What it means for plant operators
Public firmware and public CVEs are already enough input for an AI agent. As a result, any OT device reachable from the Internet becomes riskier, because the time between disclosure and exploitation is getting shorter.
Practical actions:
- remove direct Internet exposure of OT devices;
- route remote access through controlled paths, for example VPNs with strong authentication and segmentation;
- shorten patching cycles, prioritizing externally reachable devices;
- inventory your assets and periodically check what is visible on engines such as Shodan and Censys.
A lesson for engineering too
The case confirms that AI agents perform best when they work alongside domain experts and have the right tools, such as the Ghidra integration. That holds for attackers, but also for those who design, analyze and secure industrial systems: AI speeds things up, but validation remains a human responsibility.