Team82 resumes work on Danfoss

Team82 has stated it has resumed work on Danfoss following cyberattacks that occurred during the night of October 11 to 12, 2026, targeting refrigeration systems in French supermarkets. The attacks raised concerns about the security of industrial control systems used in critical infrastructure.

Report details vulnerabilities in Danfoss equipment

A report titled Firmware to Root in 30 Minutes, authored by Amir Zaltzman, details the vulnerabilities in Danfoss equipment. Danfoss assessments indicate that another researcher from Team82, Tomer Goldschmidt, had previously reported the vulnerabilities used in the test to the manufacturer, which were fixed in 2025.

Test conducted on laboratory device

The test was conducted on a laboratory device, and a researcher maintained control over the agent. The report does not claim that these vulnerabilities were used during the attacks, stating that "the precise attack path used during the attacks in France remains unconfirmed."

Experiment used AI in code editor

The experiment involved using Claude Sonnet 4.6 from Anthropic in "medium" reasoning mode within the code editor Cursor. The starting point was the public identifiers of vulnerabilities in the Danfoss AK-SM 800A controller, their classification, analysis tools, and the device's firmware.

Firmware accessible without security

Claroty noted that this firmware is downloadable from Danfoss's public website without registration or encryption to bypass. The report specifies that "no original research or private analysis was provided." Claroty estimates the operation cost approximately $6 for AI usage, with about 28 minutes between the initial analysis and a functional exploit.

Another AI-assisted cyberattack

Another offensive work assisted by a model was conducted on September 13, 2026, by the company Hacktron, which described a two-month research campaign by three researchers assisted by AI models. The cost was less than $3,000 in tokens and led them to the internal repository of OpenAI.

Agent's limitations and human oversight

The report details the limitations of the agent. It first reproduced the command injection (CVE-2025-41451) and the denial of service (CVE-2025-41452). Regarding the authentication bypass (CVE-2025-41450), it failed following "with confidence an incorrect approach." The researcher redirected the investigation and provided the agent with an MCP (Model Context Protocol) integration of the reverse engineering tool Ghidra for targeted decompilation of the main binary of the controller, a 67 MB file.

Human expertise critical to success

Claroty summarizes that "Human expertise was necessary to recognize erroneous results, ask the right questions, and validate the result." The agent then reproduced the bypass and chained it with the command injection to obtain root access.

Vulnerabilities remain a risk

Claroty concludes that for organizations relying on refrigeration and other industrial systems, "the window between public disclosure and practical reproduction of an exploit could narrow." The three vulnerabilities concern the AK-SM 800A series. Danfoss fixed them in March and August 2025.

Vulnerabilities and their fixes

The vulnerabilities and their details are as follows: - CVE-2025-41450: Authentication bypass, CVSS score 8.2, fixed in version 4.2, published on May 8, 2025. - CVE-2025-41451: Command injection, code execution after authentication, CVSS score 8.7, fixed in version 4.3.1, published on August 22, 2025. - CVE-2025-41452: External control of a configuration parameter, denial of service, CVSS score 6.8, fixed in version 4.3.1, published on August 22, 2025.

Vulnerability exploitation timeline

As of October 13, 2026, the date of Claroty's report, version 4.3.1, which closes the command injection, had been available for more than fourteen months. Version 4.2, which closes the authentication bypass, had been available since March 2025.

AI's role in faster attacks

In Japan, the research group of Professor Katsunari Yoshioka from Yokohama National University measures with its own honeypot systems the median time between the publication of a vulnerability and the first attack exploiting it. According to a report from the Jiji agency, cited on October 12, 2026, by the website Risk Taisaku, this time has decreased from 141 days in 2024 to 35 in 2026.

AI may speed up attack development

Katsunari Yoshioka estimates that the influence of AI could be significant, as generative AI may have made the writing of attack programs more efficient. He does not prove this. His first recommendation: systematically fix known vulnerabilities.

New vulnerability exploited by AI

Patrick Garrity, researcher at VulnCheck, noted that the first attempts to exploit CVE-2026-61500 appeared on October 1, 2026. This vulnerability in the free file server Rejetto HFS had been discovered using the Claude Mythos model from Anthropic, and Horizon3 detailed the method on September 30.

AI models used in attacks

On September 29, 2026, Anthropic published an analysis of the open-weight GLM-5.3 model from Zhipu AI, which Claroty cites in its report. A researcher used GLM-5.3-Flash, a smaller and less capable version of the model, to create an exploit chaining a published Chrome vulnerability (CVE-2026-11645) and a second known vulnerability. It took "20 minutes of human attention, plus eight hours of model work." Estimated cost: $20.40 at Zhipu's API rates.

CERT-FR alerts on Danfoss devices

The alert CERTFR-2026-ALE-012, published on October 12 and updated on October 13 and 16, targets Danfoss controllers from the AK-SM and AK-SC series, as well as Copeland xweb and Dixell xweb equipment. The CERT-FR states it is aware of numerous compromises. According to it, attack campaigns targeting these devices are "probably still ongoing."

Security recommendations from CERT-FR

Its first instruction: remove internet exposure of the affected units, including those with a public IP address. It asks to check insurance clauses before cutting data reporting to the service provider. Access should only be restored through a secure VPN or protected network; IP address filtering of the service provider on a firewall is acceptable in an emergency but does not constitute a long-term solution.

Danfoss systems exposed online

On October 12, researcher Baptiste Robert (Predicta Lab) counted 2,752 "systems" Danfoss accessible online worldwide, including 1,590 in France. According to Danfoss, the targeted controllers were either outdated (AK-SM 800 and AK-SC 355) or not updated (AK-SM 800A).

Outdated models no longer supported

The two outdated models no longer receive security updates, the manufacturer specifies. It recalls having long advised maintaining updated systems. The AK-SC 355 reached its end of life on October 31, 2016, according to Danfoss's withdrawal letter.

End-of-life devices remain vulnerable

The CERT-FR warns that a factory reset is insufficient: it removes persistences but leaves the vulnerability intact. According to it, an end-of-life device without a fix and exposed on the internet presents a very high probability of compromise. Danfoss recommends replacing outdated units with recent equipment.