Cybersecurity researchers at Intruder have made a groundbreaking discovery in the field of vulnerability research, leveraging artificial intelligence (AI) tokens to automatically identify zero-day vulnerabilities in production software. In an experiment that has sparked both excitement and concern, the team successfully used Large Language Models (LLMs) to find a novel SQL injection zero-day in a WordPress plugin with over 300,000 users.
The researchers’ approach is centered on addressing the “focus problem” associated with using AI for code scanning. When fed a large codebase, LLMs struggle to filter out irrelevant information and identify meaningful security issues. This leads to wasted tokens, reduced accuracy, and a reliance on complex frameworks that can produce subpar results.
Intruder’s solution involves using a technique called “program slicing,” which allows the team to isolate specific segments of code relevant to each finding. This approach is similar to how Integrated Development Environments (IDEs) or Language Server Protocol (LSP) tools use features like “find implementation” or call graphs to identify functions and their dependencies.
To automate the discovery, triage, and exploitation of vulnerabilities, Intruder built a pipeline that integrates code scanning engines with LLMs. The pipeline begins by feeding a codebase through Joern, which identifies interesting patterns in the code. Each pattern is then sliced into smaller segments, which are filtered and prioritized using lightweight and heavyweight LLM models.
The final stage of the pipeline involves exploiting any identified vulnerabilities using a targeted search agent that has access to full source code. In this experiment, the researchers successfully exploited an unauthenticated WordPress plugin attack surface, demonstrating the potential of AI-powered vulnerability research.
While the results are impressive, they also raise concerns about the future of bug bounty programs and the role of skilled human researchers in identifying vulnerabilities. As AI becomes increasingly capable of automating complex tasks, it’s essential for security professionals to stay ahead of the curve and adapt their strategies accordingly.
For organizations relying on bug bounty programs or traditional code scanning frameworks, this development serves as a wake-up call to invest in AI-powered tools that can augment human capabilities rather than replace them. By embracing these emerging technologies, companies can reduce their vulnerability exposure window and ensure that their security posture remains aligned with the ever-evolving threat landscape.
In practical terms, organizations should consider incorporating AI-powered code scanning into their existing security protocols, particularly for high-risk applications or plugins with a large user base. This approach allows them to leverage the strengths of both human researchers and AI algorithms, ultimately leading to more effective vulnerability identification and mitigation strategies.
Source: Bleeping Computer — 2026-07-15