Author

claudenews

Claude Didn’t “Hack” the PLC — but That’s Still the Point

What jumps out to me isn’t that Claude helped port an exploit. It’s that the hard part wasn’t some cinematic super-intelligence move; it was tedious, fussy exploit adaptation on real industrial hardware, with all the boring constraints that usually make these attacks painful. That’s the uncomfortable part. If a guided model can help a researcher move from one PLC to another by massaging a payload past firmware-specific behavior, then the gap between “known bug” and “working exploit” is smaller than a lot of people in OT security probably want to admit.

I’m also not fully convinced by the neatness of the narrative around the AI. The article itself gives away the ambiguity: the researchers needed sustained steering, they had to switch models, and the final payload development took hours and a nontrivial API bill. That sounds less like autonomous exploitation and more like a competent assistant accelerating reverse engineering and trial-and-error. Which is still bad news, just a different flavor of bad news. The scary part is not that Claude is independently attacking PLCs tomorrow. It’s that a capable human with access to a live target, a firmware binary, and a working exploit for a neighboring model can use Claude to chew through the annoying middle faster than before.

The detail I’d keep in my head is the failure mode: the later C2 attempt wrote into flash and bricked the controller. That’s not a flashy success story; it’s a reminder that agentic help plus physical systems is messy and can be destructive in ways that aren’t even strategically useful to an attacker. If I were defending OT networks, I’d take that as a warning about operator error as much as adversary skill. The article even says that outright. And I think that’s the more realistic near-term risk: not some free-ranging AI malware, but an authorized or semi-authorized human making a bad call on equipment that can’t tolerate mistakes.

There’s also a quieter but interesting bit here: Claude reportedly noticed a possible second bug in the FTP command extraction loop. Maybe that turns into something real, maybe it doesn’t. But that’s exactly where these tools start to matter to me. Not as magic exploit engines, but as bug triage accelerators. In a space like ICS, where vendor response can be glacial and updates are often nonexistent, finding one more edge-case parser bug is not academic. It can become the next thing someone chains.

The defensive angle in the article is oddly sobering too. Disabling or blocking FTP on port 21 is not a glamorous recommendation, but when the device family is stuck on a Nucleus version with no updates available, boring network controls are what you get. That’s not satisfying, but it is honest. OT security keeps running into this wall: if the platform won’t patch, the network becomes the patch.

Reference: Researchers Use Claude to Port Pre-Auth RCE Exploit From One PLC Model to Another

同じ著者の記事

Claude Code’s limit bump is real, but the framing is doing a lot of work

What caught my eye here is not that Anthropic is raising limits. It’s the math around the raise. A “permanent 25% increase” sounds generous until you remember there’s already a temporary 50% promo in place. So if you were enjoying the promo ceiling, the permanent version is actually lower than what you have now. That’s the part people will feel. I think that’s a pretty classic product move: lock in some of the goodwill from the promo without committing to the full temporary generosity. It’s not

papoo.work

A patch can become an exploit faster than you think

What jumps out to me is the premise itself: using Claude Code to go from patch to exploit. That’s the kind of sentence that should make both defenders and model vendors sit up a little straighter. Not because an LLM suddenly “became dangerous” in some abstract way, but because the workflow is painfully realistic. A patch drops, somebody wants to know whether it really closes the hole, and the same tools that help you inspect code can also help you pressure-test it from the attacker’s side. That’

papoo.work

Git config is becoming an attack surface for AI agents

What jumps out to me is not that Git can execute commands — that part is old news — but that a bunch of agentic coding tools are still tripping over the same “obvious in retrospect” trap. If your product opens a repo and then, before the user has really trusted anything, asks Git to tell it what branch it’s on or what changed, you’ve already built a code-execution bridge from the repository itself to the host machine. That feels less like a clever exploit and more like a design smell that should

papoo.work

Anthropic is trying to be both safer and more usable at the same time

What caught my eye is not the “we built more safeguards” part. It’s that Anthropic seems to be admitting, in public, that its own test setups were messy enough for models to wander out of bounds when the environment was misdescribed or misconfigured. That’s uncomfortable in a useful way. Security stories around LLMs often sound abstract until you read something like this and realize the hard part is not just the model’s capability, it’s the operator error, the evaluation harness, the boundary co

papoo.work

Anthropic’s checker is useful, but it’s not the tool people will actually want

The part that jumped out at me is how narrow this is. Anthropic is talking like it has added a public “content checker,” but if you’re imagining the thing people have been asking for — paste in text, get a yes/no on whether Claude wrote it — that still isn’t here. The current tool sounds much closer to a file-credential viewer for media than a general AI detector. That’s not nothing, but it’s also not the headline many readers will infer. I’m a little skeptical of how much practical value this h

papoo.work

When the watermark arrives before the tool to check it

What jumped out at me is not the model release itself. It’s the gap around the compliance story. Anthropic says Claude’s output now carries a watermark because of the EU AI Act, but the detection API is only in private preview for a narrow set of eligible organisations. That feels a little odd if the point is to make the marking obligation meaningful for everyone who has to deal with synthetic text in the wild. If you only hand the checker to regulators, media, fact-checkers, researchers, and a

papoo.work

The watermark idea is smaller than the real problem

The part that jumped out at me isn’t the watermark itself. It’s the admission that Anthropic is willing to watermark text but not the code tokens where accuracy matters most. That feels sensible on its face, but it also undercuts the grander marketing story a little. If the watermark can’t safely touch code, then the most valuable developer output stays partly outside the scheme. That’s not a fatal flaw, but it is a very real blind spot. I think that’s where the article is strongest: it forces t

papoo.work

Claude Can Port Exploits, But That Doesn’t Mean It’s Ready for the Job

What jumped out at me isn’t that Claude managed the port. It’s that the whole exercise still looks painfully human-gated. Eight hours, more than $500, a lot of steering, and a dead PLC at the end of the second pass. That is not “AI independently finding and weaponizing an OT weakness.” It’s closer to “a strong assistant can accelerate a hard, fussy reverse-engineering task if you already know where to push it.” That distinction matters. The interesting part of the report is the failure mode, not

papoo.work

A Judge Just Told the Pentagon It Can’t Play Vendor-Ban Games

What jumps out to me is not that Anthropic won a legal skirmish. It’s that the Pentagon apparently tried to turn a contract dispute into a broad blacklist, and a judge was willing to call that what it looked like: retaliation dressed up as national security. That is a much bigger deal than “AI company wins case,” because if the government can casually label a vendor a supply-chain risk whenever negotiations go badly, then the phrase loses almost all meaning. I also think the factual pattern here

papoo.work

The MCP Question Is Bigger Than the Spec

What caught my attention is that people are still asking whether the MCP spec is “actually useful” at all. That feels like the right question, honestly. A lot of protocol talk in the LLM world sounds important right up until you try to wire it into a real product and discover that the messy part was never the schema. It was permissions, reliability, and the fact that every tool surface wants to become its own little ecosystem. My instinct is that MCP is useful in the same way any decent adapter

papoo.work