Tag
AI safety guardrails intended to prevent malicious use are also hindering legitimate offensive cybersecurity researchers, who need unrestricted model access to identify and exploit vulnerabilities for defense. Researchers criticize the arbitrary gatekeeping by AI companies like Anthropic and OpenAI.
This article explores using large language models to assist in writing exploits for FreeBSD kernel vulnerabilities, detailing two exploit chains that achieve full jail escape.
This article describes how researchers at Praetorian used Claude Opus (via Claude Code) to discover and exploit vulnerabilities in the FreeBSD kernel, including a stack overflow (CVE-2026-3038) that allows escape from FreeBSD jails. Part one focuses on methodology for finding bugs.
A detailed write-up from ProjectDiscovery detailing how they discovered a critical SQL injection vulnerability in Apple's Book Travel portal via Masa/Mura CMS and achieved Remote Code Execution.
This paper presents the first cross-platform reverse engineering and protocol-aware fuzzing study of Apple AirDrop and Android Quick Share, uncovering six vulnerabilities in these widely used proximity transfer protocols.
A blog post benchmarks four approaches (Semgrep, GLM 5.1 with Strix, cloud SOTA with code review skill, and local AI with a custom harness) for finding a known LFI vulnerability in PHPIPAM, finding that the local AI harness with a tailored approach outperforms the others.
OpenAI announces GPT-5.6 Sol, a model specialized for cybersecurity, improving performance-efficiency on long-horizon security tasks like vulnerability research and exploitation.
Reversecore MCP is an enterprise-grade AI-powered reverse engineering and security analysis tool that integrates with AI assistants via the Model Context Protocol, offering 50+ tools for static/dynamic analysis, malware analysis, vulnerability research, and more.
Anthropic's study demonstrates that large language models can rapidly generate working exploits from security patches, reducing the time from weeks to hours, raising concerns about AI-driven vulnerability exploitation.
The author built a vulnerable React Native app to test if LLMs could exploit a common Firebase misconfiguration, finding that only a few models (GPT 5.5, Deepseek V4 Pro, Claude Sonnet 4.6, Claude Opus 4-8) succeeded, with GPT 5.5 having the highest solve rate.
An AI-assisted security audit of FreeBSD uncovered 15 kernel vulnerabilities, including privilege escalations and a VM escape, and details the collaborative process of reporting and patching bugs with the FreeBSD team.
New research shows that imperceptible audio signals can hijack large audio-language models (LALMs) with 79-96% success, forcing them to execute unauthorized commands like web searches or sending emails. The technique, dubbed AudioHijack, targets generative models and works regardless of user input, posing a serious security risk to voice AI systems.
Anthropic's Frontier Red Team evaluates how large language models can accelerate the exploitation of N-day vulnerabilities, finding that Claude Mythos Preview can autonomously build working exploits for 8 out of 18 Firefox patches and 8 out of 21 Windows kernel patches, highlighting increased threats during the patch gap.