LLMs Are Now Practical Vulnerability Research Tools

Someone posted about using GPT to find a WordPress RCE that exploit brokers price at $500k, at a cost of roughly $25 in API calls. The thread had the expected mix of awe and alarm. WordPress runs something like 40% of the web, so a remote code execution there is genuinely catastrophic at scale, and the fact that a well-crafted prompt chain can surface one changes the economics of offensive security research completely.

The key insight from the comments: the surprising part isn't that GPT found a bug, it's that canned WordPress exploits fetch that much money on broker markets. The model lowered the cost of finding the vulnerability to near zero, which means the barrier to entry for this kind of research, both legitimate and not, just dropped dramatically.

This connects to a broader theme on HN today around AI accelerating specialized expert tasks. Whether it's vulnerability research, fine-tuning models, or writing embedded firmware, the cost of the first competent attempt is trending toward the cost of a few API calls.