Cybersecurity researchers at Intruder have developed a cutting-edge system that leverages artificial intelligence (AI) to automatically discover and exploit previously unknown security vulnerabilities in production software. Dubbed a “vulnerability vending machine,” this AI-powered pipeline has successfully identified a zero-day SQL injection vulnerability in a popular WordPress plugin used by over 300,000 users.
The Intruder team’s innovative approach uses large language models (LLMs) to analyze code and identify potential security issues. However, they quickly realized that simply pointing the LLM at an entire codebase was not effective. Instead, they developed a technique called “program slicing,” which isolates specific segments of code relevant to each finding, thereby avoiding the issue of diluted context.
In their experiment, Intruder’s pipeline used Joern, a code scanning engine, to identify areas in the WordPress plugin that could be vulnerable to user input. The team then generated slices of code for each identified vulnerability and fed them into an LLM to triage and assess exploitability. A lightweight model filtered out obvious false positives, while a heavier model evaluated the potential impact of each vulnerability.
The most striking aspect of this research is its ability to automate the entire discovery-to-exploitation process with no human intervention. This raises serious concerns about the pace at which AI-powered attacks can be developed and deployed in the wild. As vulnerabilities are discovered and exploited faster than ever before, organizations must adapt their security strategies to keep up.
The success of Intruder’s vulnerability vending machine highlights the potential risks of using AI for cybersecurity research. While the benefits of AI-driven discovery are undeniable, they also create new challenges. Traditional code scanning frameworks have long solved the issue of diluted context by focusing on specific segments of code relevant to each finding.
In practical terms, this means that organizations should not rely solely on AI-powered vulnerability discovery tools but instead use them as a complement to traditional security measures. Moreover, researchers and developers must work together to develop more robust and effective solutions for detecting and mitigating security threats.
As the pace of technological innovation continues to accelerate, cybersecurity professionals must stay vigilant and adapt their strategies to keep up with emerging threats. The vulnerability vending machine developed by Intruder is a stark reminder that AI-powered attacks are becoming increasingly sophisticated and potentially devastating. It’s time for organizations to reassess their security posture and prioritize proactive measures to prevent these types of attacks from succeeding.
Source: Bleeping Computer — 2026-07-15