Exploit Development, Agentic Vulnerability Discovery, and Fake PoCs

AI systems can identify vulnerabilities and, for some classes, build proofs of concept that retrigger them, but finding a flaw does not establish that it is practically exploitable. Spencer McIntyre distinguishes a vulnerability, an abstract flaw with potential for harm, from an exploit, a concrete implementation that uses the flaw. A proof of concept lies between: it might only crash a program, or it might demonstrate meaningful attacker capability. Even a flaw with unproven impact deserves attention and patching.

Daniel Weitnack cited a Wall Street Journal report that AI had discovered an exploit affecting 70% of the web, but said details were still emerging as of the October 21 recording. The PHP vulnerability discussed remained in a gray area: McIntyre advised patching while research continued, saying it did not yet seem overhyped. Reports that it reaches back to PHP 5 could encompass old, unpatched devices and products from defunct vendors, while PHP’s use across applications, appliances, vendors and operating systems makes the actual exposure difficult to establish.

McIntyre leads exploit development on Volncheck’s initial access team, which supplies data for its initial access intelligence feed, including timely vulnerability information, exploit data, detections and high-level descriptions. Volncheck uses its open-source GoExploit framework to standardize checks, target validation, exploitation and command-and-control setup. That scaffolding and a growing exploit corpus help large language models produce more useful work than starting from scratch; the team’s exploit backlog grew by about 50 additions the previous week, with about 60 expected that week. McIntyre also described Metasploit, which celebrated its 21st birthday the previous year, as a framework for developing, sharing and validating exploits in a normalized format.

AI models including Mithos, Opus-5.5, OpenAI models and GLM can help discover flaws, but researchers still need to connect code-level analysis to a functional exploit and establish its utility to an attacker. CVSS alone is insufficient for prioritization when many vulnerabilities score 9 or higher; attacker utility and business impact also matter. Models have performed well on open-source web-application flaws such as token-handling logic bugs, expression-language injections and file leaks, but struggle more with closed-source targets requiring reverse engineering, including firmware and proprietary x86 software, and with patch diffing. Formal cyber-verification programs have not noticeably expanded their capabilities, according to the speakers.

Sensitive research also raises concerns about stricter guardrails and how hosted providers handle submitted data, leading some researchers to run models locally. One cited case involved a closed-source model uploading repositories later found in an S3 bucket. McIntyre had not been accepted for Mithos access but had hands-on experience with other models; he also expected some exploit-research usefulness to decline when versions such as Opus 4.6 or 4.8 were sunset, possibly in February. Offensive-security researchers sometimes downgrade American proprietary models to avoid restrictions.

Volncheck reviews public CVE-linked proofs of concept from GitHub, CodeBurg, GitLab and other sources, while team members also develop exploits and validate public submissions. Distribution has shifted from centralized forums such as Exploit-DB and Packet Storm toward GitHub. In 2026, more than 50% of reviewed PoCs were judged illegitimate because they were broken or failed the team’s standards; the review did not assess whether they were AI-generated. McIntyre said the average PoC found today is unlikely to leverage its stated vulnerability or demonstrate attacker utility.

Agent swarms could scale vulnerability discovery much like fuzz farms, but shared off-the-shelf harnesses may lead teams to find the same bugs, so researchers are building their own harnesses and prompts. AI-developed exploits remain less reliable than human-developed ones at achieving comparable impact: an agent may stop at a crash that is only theoretically exploitable or pursue a path less useful to an operator, while humans bring context about attacker goals. McIntyre sees agents helping identify and filter vulnerabilities for human experts to validate and improve, potentially accelerating analysis and response and reducing attackers’ advantage from time spent developing vulnerabilities. He had not seen evidence of wide-scale exploitation, but said that could change within three to six months; how courts will assign responsibility for breaches involving AI-assisted attacks remains unsettled.