AI helped find 66 security flaws, with no fixes planned for some older devices

Researchers at cybersecurity company Forescout used commercially available AI to find 66 previously unknown flaws in embedded networking software, exposing weaknesses that can disrupt connected devices, according to the company's Nov. 12 announcement.

The team validated 99 vulnerabilities across 10 TCP/IP stacks, the software components that let devices communicate over networks. That total included 33 rediscovered issues. Forescout reported 54 of the new findings to vendors or maintainers because it believed they still affected current versions.

The researchers built a specialized system combining conventional code analysis with Anthropic's Claude models. It examined both open-source code and proprietary binaries, then used dynamic testing to validate potential flaws. Researchers could intervene and guide that testing.

Forescout's research reports roughly 10 hours of automated analysis and 80 hours of dynamic validation. It compares that with about nine months of manual code analysis during its earlier Project Memoria work.

The comparison involves different target sets, rather than a controlled benchmark. It also excludes building that system, refining analysis rules and prompts, and developing the infrastructure needed to emulate embedded software.

Static analysis cost about $935 in model spending; Forescout estimates total model spending at roughly $1,200 to $2,300. Those figures describe the cost of applying an already-built system, rather than the full expense of expert research and setup.

The approach also had limits: it rediscovered 33 of 82 known issues, or 40%, in the previously studied target set and was less effective at finding implementation-specific logic and design flaws.

Fixes depend on the device

The study includes flaws affecting building-automation products covered by Siemens' Oct. 13 advisory. The advisory identifies vulnerabilities in specified APOGEE, TALON and Desigo PXC/PXM products. Depending on the issue and product, an unauthenticated remote attacker could read device memory or cause a denial of service.

Siemens lists updates for affected APOGEE PXC and TALON variants, but no planned fix for listed APOGEE MBC/MEC and Desigo products. It recommends issue-specific mitigations, including disabling affected FTP/web services or placing controllers behind network segmentation and properly configured gateways or firewalls. The advisory notes that FTP/web services are disabled by default on the named product lines.

Compare Siemens' device response

Siemens lists updates for specified affected APOGEE PXC and TALON variants. The path shows what operators must do, not an observed installation.

AI-assisted discovery can accelerate finding flaws while device support still governs remediation.

Research is AI-assisted and human-supervised. Siemens' advisory predates the November 12 announcement. Product and flaw scope varies; a listed update does not prove firmware installation. Mitigations are issue-specific and do not replace a software fix.

Sources and evidence

Sources

1. Forescout research
2. Forescout November 12 announcement
3. Siemens advisory, October 13

Supporting facts

• Forescout announced its AI-assisted embedded-networking research on November 12, 2026. [2]
• Forescout says researchers validated 99 vulnerabilities across 10 TCP/IP stacks: 66 previously unknown findings and 33 rediscovered issues. [1] [2]
• Of the 66 new findings, Forescout reported 54 to vendors or maintainers because it believed they still affected current versions. [1]
• The harness combined deterministic static analysis with Anthropic's Claude models and researcher-supervised dynamic verification, analyzing both open-source software and proprietary binaries. [1]
• Siemens lists updates for specified affected APOGEE PXC and TALON variants but says no fix is planned for listed APOGEE MBC/MEC and Desigo PXC/PXM products. [3]
• Siemens recommends disabling affected FTP/web services where applicable and using network segmentation and gateways or firewalls for the relevant controller flaw; it notes FTP/web services are disabled by default on the named product lines. [3]
• Forescout says shared networking components can spread flaws into downstream devices and recommends reducing exposed services and isolating unsupported devices while applying available fixes. [1]

Method

Reported counts are 99 validated issues, 66 new and 33 rediscovered. The bar widths use 66:33 (480:240 desktop; 194.6667:97.3333 mobile), verified by arithmetic. Fifty-four is a subset of the 66 new findings. Selectable panels contrast specified product groups, not successive dates or measured protection outcomes.

Scope

Research is AI-assisted and human-supervised. Siemens' advisory predates the November 12 announcement. Product and flaw scope varies; a listed update does not prove firmware installation. Mitigations are issue-specific and do not replace a software fix.

Infographic by CryptoSlate

Another finding involves lwIP, an open-source networking stack. An Oct. 26 maintainer fix addresses an MQTT parsing loop under certain buffer configurations. Forescout says the flaw could let a malicious messaging broker freeze a device's network services with a crafted message. Both that fix and Siemens' advisory predate the November research announcement.

Disclosure remains unfinished. Forescout's report lists three unnamed proprietary stacks as under investigation and Ethernut as having provided no response. Forescout also says open-source CVE identifiers are still awaiting assignment.

For operators, Forescout recommends reducing unnecessary service exposure, isolating devices that cannot be patched and applying available fixes. Faster discovery still leaves protection dependent on whether a vendor supports a device and whether a fix reaches it.