Firmware to Root in 30 Minutes: How AI is Changing Threat Intelligence

This week’s cyberattacks affecting supermarket refrigeration systems in France underscores how disruptions and damage to industrial equipment can lead to, in this case, food waste and significant financial loss. It also demonstrates how an attacker can leverage an unsecure internet-facing asset to impose real damage on critical infrastructure. 

The precise attack path used in the France attacks remains unconfirmed; we know that Danfoss refrigeration systems were targeted. Earlier this year we published research that provides some detail on authentication bypass and operating-system command execution vulnerabilities in Danfoss AK-SM 800A refrigeration controllers. 

Given this week’s incidents, we decided to revisit our findings, but with a timely question: How quickly and inexpensively could an AI coding agent reproduce our three previously disclosed vulnerabilities?

This blog will answer this question and more: 

• How Claroty Team82 revisited its initial research on refrigeration controller vulnerabilities and the results

• Why keeping a human-in-the-loop is so important and why it mattered in this instance

• How advanced AI capabilities are lowering the barrier to entry for hackers and researchers

The Experiment: 28 Minutes, Approximately $6

Using Anthropic’s Claude Sonnet 4.6 in medium reasoning mode through the Cursor AI-native code editor, we reproduced the vulnerabilities and chained two to achieve root-level command execution on a lab device.

• Time and cost: Approximately 28 minutes from initial analysis to a working exploit, for about $6 in AI usage.

• Accessibility: Firmware downloaded directly from Danfoss's public website, with no registration required or encryption barrier to overcome.

• Starting point: Public CVE identifiers and vulnerability classifications, the firmware package, and analysis tools. No original research or private analysis was provided.

• Internet exposure: Quick searches on Censys and Shodan revealed thousands of potentially exposed devices, highlighting the scale of the attack surface. Internet-facing systems may be reachable without an attacker first breaching an organization's internal network.

Human Guidance Still Matters 

The agent initially reproduced two vulnerabilities (CVE-2025-41451 and CVE-2025-41452) but failed to correctly analyze the authentication bypass (CVE-2025-41450), confidently pursuing an incorrect approach.

We redirected the investigation and provided a Ghidra Model Context Protocol (MPC) integration for targeted decompilation and cross-reference analysis of the controller's 67 MB main application binary. Ghidra is a reverse-engineering platform. 

With the right tools and guidance, the agent reproduced the bypass and chained it with command injection to demonstrate root access.

The researcher remained essential, but hands-on analysis was substantially reduced. Human expertise was needed to recognize incorrect results, ask the right questions, and validate the outcome. Once equipped with the appropriate tools and direction, the agent automated much of the subsequent analysis and vulnerability reproduction.

Why This Matters

Anthropic's recent analysis of GLM-5.3 raises broader questions about how advanced cyber capabilities are becoming accessible beyond the most powerful proprietary models. Our experiment examines the practical implications for OT security: even a relatively modest AI coding model, paired with publicly available vulnerability information, accessible firmware, and analysis tools, can reproduce known vulnerabilities in minutes for just a few dollars.

This was not an autonomous vulnerability discovery from scratch. Public CVEs provided the starting point, and researcher guidance helped overcome the agent's initial failure. Nevertheless, the combination of low cost, minimal time, limited human intervention, and internet-exposed devices makes reproducing known vulnerabilities increasingly practical for real-world attackers.

For organizations relying on refrigeration and other OT systems, the window between public disclosure and practical exploit reproduction may be shrinking. Publicly available firmware, internet exposure, and the perceived complexity of industrial equipment should not be mistaken for security.