Claroty Team82 demonstrates AI can reproduce Danf controller exploits in 28 minutes
Research shows AI coding agents can chain vulnerabilities in Danfoss refrigeration controllers to achieve root access quickly and cheaply.
Key points
- AI agent reproduced three Danfoss controller vulnerabilities in 28 minutes at a cost of roughly $6.
- Researcher guidance was required to correct the agent's initial failure to analyze the authentication bypass flaw.
- Internet-exposed OT devices remain vulnerable, with thousands potentially accessible via external network scans.
Claroty’s Team82 research team successfully reproduced three previously disclosed vulnerabilities in Danfoss AK-SM 800A refrigeration controllers using an artificial intelligence coding agent, according to a report by Industrial Cyber. The experiment demonstrated that an AI tool could chain two of these flaws to achieve root-level command execution on a laboratory device in approximately 28 minutes.
The team utilized Anthropic’s Claude Sonnet 4.6 operating in medium reasoning mode through the Cursor AI-native code editor. This setup allowed them to process publicly available firmware, vulnerability identifiers, and analysis tools. The total cost for the AI usage during this reproduction effort was approximately US$6, highlighting the low financial barrier for potential attackers using similar automated methods.
Methodology and Researcher Intervention
The AI agent initially reproduced CVE-2025-41451 and CVE-2025-41452 without significant issues. However, it failed to correctly analyze the authentication bypass vulnerability, CVE-2025-41450, and pursued an incorrect approach with high confidence, according to Amir Zaltzman, a vulnerability researcher at Team82. This misstep underscores that AI tools are not infallible and require human oversight to validate results.
To correct the agent’s trajectory, researchers provided a Ghidra Model Context Protocol integration. This allowed for targeted decompilation and cross-reference analysis of the controller’s 67 MB main application binary. Ghidra is a well-known reverse-engineering platform that assisted the AI in understanding the complex binary structure.
With this specific guidance and tooling, the agent successfully reproduced the authentication bypass. It then chained this flaw with command injection to demonstrate root access on the device. Zaltzman noted that while hands-on analysis was substantially reduced, human expertise remained essential to recognize incorrect results and ask the right questions.
Exposure Risks for Operational Technology
Team82 stated that these findings illustrate how AI coding tools can lower the time, cost, and expertise required to reproduce known vulnerabilities affecting operational technology systems. The ability to automate complex reverse-engineering tasks could enable less skilled attackers to develop functional exploits for industrial equipment more rapidly than before.
The researchers used Censys and Shodan to search for potentially exposed devices online. These searches identified thousands of devices that may be vulnerable, according to the report. This widespread exposure underscores the significant risks associated with internet-facing industrial equipment that attackers can reach without compromising an organization’s internal network first.
What should you do?
Security teams should prioritize identifying Danfoss AK-SM 800A controllers that are directly exposed to the internet. Removing unnecessary external access to operational technology assets can significantly reduce the attack surface. Organizations should also monitor for unusual command execution or authentication bypass attempts on these specific devices.
What to do and how to stay safe: Danfoss
- Conduct a network scan to identify any Danfoss AK-SM 800A controllers that are directly accessible from the public internet.
- Review firewall rules to ensure that operational technology devices are isolated from external networks and not exposed to untrusted zones.
- Monitor logs for signs of exploitation related to CVE-2025-41450, CVE-2025-41451, and CVE-2025-41452 on affected refrigeration controllers.
- Wait for official vendor guidance or patches for these specific vulnerabilities before attempting manual remediation steps.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which specific vulnerabilities were reproduced by the AI agent in this experiment?
The AI agent reproduced CVE-2025-41451, CVE-2025-41452, and CVE-2025-41450 in Danfoss AK-SM 800A controllers.
Did the AI agent complete the task without any human assistance?
No, the AI required researcher guidance and Ghidra integration to correctly analyze the authentication bypass vulnerability and demonstrate root access.
What is the estimated cost to use AI for this type of vulnerability reproduction?
The AI usage cost for reproducing the exploits and achieving root access was approximately US$6.
