Many APs have WPS implementations that can be trivially brute-forced and can't be disabled. Paper: http://sviehb.files.wordpress.com/2011/12/viehboeck_wps.pdf

Open-source tool: http://code.google.com/p/reaver-wps/