Topic
The use of AI models and automated tools to find, analyze, and exploit software vulnerabilities, reshaping security research and disclosure practices.
Tencent Zhuque Lab published working demos on October 12 for Vghost (CVE-2026-74580), a vhost bug that gives local users root on Linux 4.11 through 7.2-rc4. The August 3 fix is out, but Ubuntu 24.04 and 26.04 kernels were still listed as in progress on October 13.
Reality
Chainguard says its Mythos harness found a vLLM flaw, left in the public tracker for four months, that lets one client force another client's output. Versions before v0.31.0 are affected, and nothing is logged when the forced answer returns.
Reality
Microsoft's FORGE lab helped discover Windows flaws assigned 140 CVEs from May to September 2026, 52 of them fixed in the September release. Microsoft says the pace now depends on how fast its response center can validate and fix what the AI agents report.
Reality
Cantina released apex-flash-1, an open-weights vulnerability-research model it says solved 40 of 60 tasks for $2.38, against $74.68 for Claude Opus 5 High. There is no hosted endpoint, so teams download the 321-billion-parameter weights, pay for their own inference and verify the numbers themselves.
Reality
Hacktron reports that GPT-5.6 Sol Ultra built a complete Chrome/V8 exploit chain in a controlled test for $1,596.89 of model compute. The benchmark handed the model the source tree and the public security-fix commits, so the figure covers only the compute for one lab task.
Reality
Cantina released Apex Flash-1, an open-weights security model fine-tuned on 50 of its own vulnerability cases. Its only performance evidence is a 60-task evaluation the company ran itself, and a separate build is modified to refuse fewer requests.
Reality
Disclosure volume is climbing faster than the process around it. CISA's answer is a framework that describes what a good CVE record is and how the program should be judged on producing one.
Perspective Coverage
3 publishersReality
Cloudflare pointed Anthropic's Mythos Preview at more than fifty of its own repositories and watched it write, compile and run its own proofs of exploitability. Its refusals on identical code did not repeat.
Reality
Ledger's CTO says the Ethereum clear-signing fix shipped two weeks before disclosure. The public release record cannot confirm that, and an autonomous scanner chose the publication date.
Reality