“A Vulnerability Vending Machine”: How AI Finds Zero-Days

Intruder has shared details of an automated vulnerability-hunting system that its own creators jokingly dubbed a “vulnerability vending machine”: large language model tokens go in, and discovered zero-day vulnerabilities come out.

How It Works

The approach combines slicing source code into fragments (“code slicing”) with LLM-based analysis. This combination lets the system automatically find complex vulnerabilities that are hard to spot with traditional static analysis or manual auditing.

The Zero-Day It Found

To demonstrate the system's capabilities, Intruder showed how it discovered and successfully exploited a previously unknown zero-day vulnerability in one of the plugins for WordPress. According to the company, this is far from its only find — a number of other discovered vulnerabilities are already in the responsible disclosure stage with the developers of the software in question.

What It Means for the Industry

The emergence of such tools reflects a broader trend: language models are increasingly being used not only to write code, but also to analyze it for security issues. Automating the discovery of complex vulnerabilities could potentially speed up the detection of problems before attackers exploit them — yet it also raises questions about how such technologies could be turned to the opposite, malicious ends.

Intruder is not disclosing the full technical details of the system, but notes that work on expanding its capabilities continues, and that the vulnerabilities it uncovers are passed on to the makers of the affected software as part of standard responsible disclosure procedures.

Source: Bleeping Computer