Claroty's Team82 published an experiment on 13 October, by Amir Zaltzman, with a question in it that most vendors would not have asked out loud: how quickly and cheaply could an AI coding agent reproduce vulnerabilities the team had already disclosed itself.

The answer was about 28 minutes and about 6 dollars.

Before that number travels any further than it already has, the rest of the experiment needs to travel with it.

What it was given

The agent was Claude Sonnet 4.6 in medium reasoning mode, driven through the Cursor editor. Its inputs were the public CVE identifiers and their classifications, the Danfoss firmware package downloaded from the vendor's own public website, and ordinary analysis tools. Team82 states that no original or private research was handed over.

The targets were the three flaws in the Danfoss AK-SM 800A that Team82 disclosed in August, and which are now sitting in the background of the supermarket refrigeration attacks.

What it did, including the part that failed

It reproduced two of the three: the command injection and the web server configuration issue.

On the third, the authentication bypass, it failed. Team82's description is that it confidently pursued an incorrect approach. A human redirected it, and a Ghidra integration was added so it could decompile and cross-reference the controller's 67 MB main binary. With those, it reproduced the bypass and chained it with the command injection to get root on a lab device.

So the headline figure covers a run in which the agent got two out of three on its own, went confidently wrong on the hardest one, and finished only after a researcher told it where to look and gave it a better tool.

Team82 is more careful than the coverage will be

Three sentences from the research are worth more than any summary of it.

"This was not an autonomous vulnerability discovery from scratch."

"The researcher remained essential, but hands-on analysis was substantially reduced."

"the window between public disclosure and practical exploit reproduction may be shrinking."

The last one is the actual finding, and it is narrower and more useful than the headline. The claim is not that models find bugs. The claim is that the gap between a CVE being published and somebody having a working exploit for it is getting shorter.

What the six dollars does not include

It is model usage only. It does not include the researcher's time, and a researcher was in the loop, redirecting and tooling. It does not include the original research that produced the three CVEs in the first place, which took far longer than 28 minutes.

No new vulnerability was found. The work was reproduction of known issues with known classifications, which is a genuinely different task from discovery.

And the root shell was on a lab device. Nothing was run against a production controller.

Why it still matters

Strip out the exaggeration and a real change remains. Patch timelines are built on an assumption that turning a published advisory into a working exploit takes an attacker meaningful effort. That assumption is what makes a fourteen-day window feel reasonable.

If a CVE identifier, a classification and a downloadable firmware image are now enough to get most of the way in under half an hour, then the dangerous period after disclosure is shorter than most patch cycles are designed for. That is the argument, and Team82 makes it without claiming more than it demonstrated.

It also has an uncomfortable neighbour. The research reproduced here concerns controllers that were still exposed in the thousands when somebody defrosted several hundred shops across Europe.

What to do

  • Stop treating public disclosure as the start of a comfortable window. Price your remediation on days, not weeks, for anything internet-facing.
  • Prioritise by exposure rather than by score where the two disagree. Reproduction effort was the hidden variable in that trade-off and it is falling.
  • Download your own firmware and check what a CVE identifier plus a classification would give somebody. That is the attacker's actual starting position.
  • Be specific when you quote this. Twenty-eight minutes to reproduce three disclosed CVEs with a human in the loop is not twenty-eight minutes to find a new one.
  • Read the vendor's own limitations section before the headline. In this case the vendor wrote a better one than most reporting will.

What is not established

  • Whether a model can find an undisclosed vulnerability in this firmware. The experiment did not try.
  • How many human interventions were needed. One redirection is described; the total is not given.
  • What the real cost was. The six dollars is model usage alone.
  • Whether the same result holds on firmware with no public CVEs to aim at.
  • Whether any attacker is working this way. The experiment is a lab exercise, not an observation.
  • Whether these vulnerabilities were used in the refrigeration attacks. Claroty says that path is unconfirmed.