AI helped find 66 security flaws, with no fixes planned for some older devices

The research combined about 10 hours of automated analysis with 80 hours of validation, excluding development of the specialized system. Siemens lists updates for some affected controllers, while several listed legacy products have no planned fix and require mitigations.

AI-Powered Discovery Process

Researchers built a specialized system combining conventional code analysis with Anthropic's Claude models. It examined both open-source code and proprietary binaries, then used dynamic testing to validate potential flaws. The approach cost approximately $935 in model spending for static analysis, with total estimated model expenses ranging from $1,200 to $2,300.

Device-Specific Response

The study includes flaws affecting building-automation products covered by Siemens' Oct. 13 advisory. Siemens lists updates for affected APOGEE PXC and TALON variants, but no planned fix for listed APOGEE MBC/MEC and Desigo products. The company recommends issue-specific mitigations, including disabling affected FTP/web services or placing controllers behind network segmentation.

Another finding involves lwIP, an open-source networking stack. An Oct. 26 maintainer fix addresses an MQTT parsing loop under certain buffer configurations. Forescout notes the flaw could let a malicious messaging broker freeze a device's network services with a crafted message.

Ongoing Challenges

Disclosure remains unfinished, with Forescout reporting three unnamed proprietary stacks still under investigation and Ethernut having provided no response. The company also notes open-source CVE identifiers are still awaiting assignment.

For operators, Forescout recommends reducing unnecessary service exposure, isolating unpatchable devices, and applying available fixes. The research demonstrates that while AI can accelerate discovery, protection ultimately depends on vendor support and whether fixes reach affected devices.