AI found 66 new flaws in factory and hospital equipment software in 90 hours, for about the cost of a laptop

Security firm Forescout said Thursday that off-the-shelf AI found 66 previously unknown flaws in networking software used inside factory equipment, medical devices and smart infrastructure. The job took about 90 hours. Forescout estimates the same review by hand would have taken nine months.

The cost is the headline for anyone who runs physical equipment. Forescout puts the automated code analysis across all 10 software packages at about $935. It also told Cybersecurity Dive it spent an estimated $1,200 to $2,300 on AI usage in total, which it called roughly one hundredth of a senior bug-hunter's salary.

That matters because the same tools are available to attackers. Finding flaws in the hidden software that runs pumps, sensors and hospital gear used to take scarce experts many months. It is now a task a small team can run on a modest budget.

What the AI found, and what it missed

Forescout's research arm, Vedere Labs, pointed an AI-assisted bug-hunting setup at 10 widely used TCP/IP stacks. These are the small software components that let a device talk over a network. Cybersecurity Dive reports the setup ran on Anthropic's Claude models. Seven of the stacks had been studied by Forescout before; three were new.

In total the system turned up 99 confirmed flaws: 66 new and 33 already known. Forescout says 52% of the new ones are rated high or critical severity. Cybersecurity Dive names some of the affected code, including software used in street lights, smart devices and safety-critical systems.

The headline numbers deserve some caution. The "90 hours" includes roughly 80 hours of human checking; the AI itself ran for about 10. Forescout also says the system re-found only about 40% of the flaws already known in those stacks. In other words, it missed most of the bugs experts had previously caught.

It was also uneven by type. Cybersecurity Dive reports the setup was strong at memory errors in code that reads network traffic, but weak at flaws in a product's logic or design. The logic bugs it did find, it found largely by accident.

"AI did not eliminate the need for expert vulnerability researchers," said Daniel dos Santos, Forescout's head of research, "but it dramatically compressed the work." The results come from Forescout itself and have not been independently replicated.

The problem is fixing them, not finding them

For buyers, the uncomfortable part is what happens next. Forescout has reported 54 of the new flaws to the people who maintain the software. As of Thursday, 24 had been fixed and 29 were still being investigated, according to Cybersecurity Dive. The developer responsible for the one remaining reported flaw had not responded.

Even a fix at the source is only the first step. The patch must travel from the software maker to the device maker, into new firmware, and finally onto equipment in the field. For industrial and medical gear, that chain can take years. Forescout says flaws in these components are likely to reach hundreds of products from dozens of vendors, based on its past research.

Some devices will never be patched at all. The AI found seven flaws, including built-in administrator logins, in software used by a wireless access point that is no longer supported. Forescout warned that AI can now quickly and cheaply surface dangerous flaws in products for which no vendor will be able to provide a fix.

Barry Mainz, Forescout's chief executive, said containing risk, rather than patching, must now be the priority. Forescout's own business is helping organizations see and contain connected devices, so its recommendations are not disinterested.

What it means for operators and investors

The research fits a pattern. In March, Anthropic said its Claude Opus 4.6 model found 22 security flaws in the Firefox web browser in about two weeks. Forescout's work suggests the same economics now extend to the embedded software inside physical infrastructure, where fixes are far slower.

For hospitals, manufacturers and utilities, that shifts the planning question. The number of known flaws in their equipment is likely to rise faster than vendors can ship fixes. Forescout's advice is to rank flaws by whether attackers can actually reach them, switch off unneeded network services, and wall off devices that cannot be updated.

It also urges buyers to write security into purchase contracts. That means a defined support lifetime, a published policy for handling flaw reports, a list of the software components inside each product, and ongoing testing. Those terms are cheap to ask for at signing and expensive to retrofit later.

Software makers face their own bill. Forescout tells them to build AI bug-hunting into their release process and to prepare for a surge of AI-generated flaw reports. For small open-source projects that underpin many commercial products, often maintained by a handful of volunteers, that surge could be hard to absorb.