AI Helped Find 66 Security Flaws in Embedded Software

Cybersecurity researchers at Forescout successfully used commercially available artificial intelligence to uncover 66 previously unknown security flaws within embedded networking software. The findings expose critical weaknesses capable of disrupting connected devices across various networks. To achieve these results, the team developed a specialized system pairing conventional code analysis with Anthropic Claude models. This setup examined both open-source code and proprietary binaries, utilizing dynamic testing to validate potential vulnerabilities while allowing researchers to guide the process.

The automated workflow required roughly 10 hours of analysis and 80 hours of dynamic validation, contrasting sharply with the nine months of manual code analysis needed during previous projects. Static analysis model spending cost approximately $935, with total model expenses estimated between $1,200 and $2,300. However, these figures reflect only the application of an existing system rather than the full setup and research expenses. Despite its speed, the method had limitations, missing certain implementation-specific logic and design flaws, and rediscovering 40 percent of known issues in a previously studied target set.

AI-powered analysis rapidly uncovered dozens of new networking software vulnerabilities.

The investigation encompasses building-automation products highlighted in an earlier Siemens advisory, which identified vulnerabilities permitting unauthenticated remote attackers to read device memory or trigger denial of service conditions. While Siemens provided updates for specific APOGEE PXC and TALON variants, certain APOGEE MBC/MEC and Desigo products have no planned fixes, leaving operators dependent on mitigations like network segmentation or disabling FTP services. Additional findings affected the open-source networking stack lwIP, prompting a maintainer fix for an MQTT parsing loop. Disclosure remains ongoing, with several proprietary stacks under investigation and open-source identifiers awaiting assignment.

Why it matters

This research highlights how artificial intelligence can dramatically accelerate vulnerability discovery in networking software, shrinking timelines from months to hours. However, faster discovery does not automatically guarantee safety, as remediation depends entirely on vendor support and whether patches reach deployed devices. Operators must proactively manage risk by isolating unpatchable systems and minimizing unnecessary service exposure.

Future Outlook and Security Impact

The integration of AI models into cybersecurity research marks a shift in how software vulnerabilities are identified. As automated tools become more accessible, organizations face mounting pressure to address legacy systems and unpatched devices before malicious actors exploit discovered weaknesses.