The researcher argues that spending $25 in API costs to find a bug that clears $500,000 on the exploit broker market demonstrates a fundamental shift in the economics of vulnerability research. They frame GPT-5.6's ability to enumerate sinks and trace reachability from unauthenticated entry points as a repeatable methodology, not a one-off lucky find, backed by a documented prompt scaffold and cost breakdown.
The writeup emphasizes that most model-flagged candidates were false positives or already-patched paths, and only manual verification separated signal from noise. The researcher's methodology is deliberately unglamorous — structured chunks, sink enumeration, backward tracing, then hand-checking — which implicitly rebuts the framing that the LLM alone found the bug.
The synthesis notes that the vulnerability class — PHP object injection via a nopriv_ AJAX endpoint — is a classic, well-understood pattern that predates LLMs. That such a bug survived in a plugin with millions of installs suggests the plugin ecosystem's audit surface has always been thin, and GPT-5.6 mainly lowered the cost of exploiting that thinness rather than discovering a novel technique.
A researcher at SecLabs published a writeup describing how they used GPT-5.6, working from a plain source-code checkout of a popular WordPress plugin, to identify an unauthenticated remote code execution vulnerability. Total spend on the model: roughly $25 in API calls. Total time: an afternoon. The same class of bug — pre-auth RCE in a plugin with millions of installs — regularly clears $500,000 on the private exploit broker market, where firms like Zerodium and Crowdfense publish standing bounties for WordPress and Drupal core and top-tier plugin chains.
The methodology in the post is deliberately unglamorous. The researcher piped the plugin's PHP source into GPT-5.6 in structured chunks, asked the model to enumerate sinks (calls to `eval`, `unserialize`, `system`, `include` with tainted input, SQL string concatenation), then asked it to trace backwards from each sink to any code path reachable without authentication. When the model flagged a candidate, the researcher verified it by hand — most were false positives or already-patched paths. One wasn't. The bug was a classic PHP object injection reachable via an AJAX endpoint that the plugin registered for `nopriv_` users, meaning any unauthenticated visitor could trigger it.
The writeup includes the prompt scaffolding, the model's chain-of-reasoning for the winning finding, and a rough cost breakdown: ~$18 on the initial sink enumeration pass across the whole codebase, ~$5 refining the trace, ~$2 on a final validation pass. The vulnerable plugin has been reported to the vendor and is under embargo; the post identifies neither the plugin nor the CVE.
The cheap-audit-finds-expensive-bug pattern is not new — Tavis Ormandy has spent a decade demonstrating it with grep and coffee — but the economics have shifted in a way that's worth stating plainly. A year ago, LLM-assisted vulnerability discovery mostly produced confident-sounding hallucinations about functions that didn't exist. GPT-5.6 and its peers now cross the threshold where they produce fewer false positives than a junior pentester and can actually reason about taint flow across files.
What's genuinely new here is not the finding — WordPress plugins have been a bug swamp forever — but the labor arithmetic. A traditional manual audit of a mid-sized WordPress plugin runs a competent auditor two to five days. At $200/hr blended rate, that's $3,200 to $8,000 in human time before you know whether there's anything to find. The SecLabs run compressed the first pass to hours and $25. Even if you assume the researcher spent another full day on the manual verification loop — which the post suggests — the total cost is a rounding error against the $500k ceiling. The arbitrage between finding a critical WordPress RCE and selling it is now roughly 20,000x, and the tooling to close that gap is a credit card and an OpenAI account.
The defensive read is not "AI will find all the bugs." It's that the offensive side of this arbitrage is now available to anyone with $25 and reading comprehension. The WordPress plugin ecosystem — roughly 60,000 plugins, most maintained by one person, many abandoned — was already the soft underbelly of the web. It is now systematically enumerable by anyone who wants to run a batch job. Wordfence and Patchstack, the two commercial defenders in this space, will need to keep pace or the disclosure firehose is going to change shape fast.
One caveat worth flagging: the writeup is a single data point, and single data points are exactly the kind of thing that get reposted as "AI finds bugs for pennies!" until someone tries it on their own codebase and gets nothing but hallucinated CVE numbers. The researcher is experienced, the prompt scaffolding is nontrivial, and PHP is unusually amenable to this style of analysis because taint sources and sinks are lexically obvious. Try the same trick on a well-factored Rust codebase and you'll spend $25 to be told your code looks fine.
If you maintain WordPress plugins, or any PHP code that accepts user input on a public endpoint, the calculus for "should I run an LLM audit before shipping" has flipped. It costs less than a lunch and catches the bugs that get you SLA'd off Cloudflare. Add it to your CI: on every merge to main, run a scoped prompt against the diff, ask specifically about the auth boundary and any new sinks, and pipe the output to a human reviewer. The false-positive rate is still high enough that you want a human filter, but the cost of running it is negligible.
If you consume WordPress plugins — which is most of the web — assume every plugin you have installed has been (or will shortly be) run through a similar pipeline by someone with different intentions. The practical response is boring but overdue: audit your installed plugin list, remove the ones you don't use, subscribe to Wordfence or Patchstack for the ones you do, and put a WAF in front of `/wp-admin` and `/wp-json`. None of this is new advice. What's new is that the window between "vulnerability exists" and "vulnerability is actively exploited by someone who paid $25 to find it" is getting measurably shorter.
For security teams outside the WordPress bubble, the transferable lesson is that the economics of finding low-hanging bugs in second-tier open source have changed. Every npm package with 10M downloads and one maintainer, every Composer library that ships an `eval` you can reach, every Django admin plugin someone wrote in 2019 — the audit cost just dropped by two orders of magnitude. Whoever runs the batch job first sets the market.
The interesting question is not whether LLMs find bugs — they do — but whether the disclosure ecosystem can absorb the volume. If ten researchers copy the SecLabs playbook next week, MITRE's CVE assignment queue, already famously backlogged, will buckle. Expect the next twelve months to produce a lot of noise, a nontrivial number of real critical findings in software you're running, and at least one embarrassing incident where an LLM-assisted researcher publishes a bug that turns out to have been in the codebase for eight years and shipped in every major distro. Buy popcorn, patch WordPress, and stop leaving 40 unused plugins installed on the marketing site.
https://github.com/WordPress/WordPress/commit/3a640e1c5e39aa...String concatenation SQL injection in the year 2026.
I am so done with FOMO writing. Sure man, you found one with $25. With $25 plus your entire industry domain specific knowledge of where to look, of how to probe, of what else you may have accumulated and collected over the years of working within this industry. Let's stop with the gambling narr
The surprising (and possibly untrue) thing is the high price of canned vulnerabilities. WordPress is known as the remote root shell with a blogging feature.
Interesting write-up and I do think LLM assisted/powered exploit disclosure is a real concern (I've been able to get models to create container breakouts from Linux LPEs relatively quickly).One thing I'm surprised about is that GPT-5.6 didn't block that prompt due to guardrails.
Top 10 dev stories every morning at 8am UTC. AI-curated. Retro terminal HTML email.
There is no evidence that $500k has been paid or would be paid for an exploit like this one.Given that the article says that prompts are modified like they are holy scripture, perhaps sell the prompt for $500k.The author works for https://www.assetnote.io/ , which has AI products for