FOUR TIMES AI ACTUALLY HACKED SOMETHING REAL, AND WHAT EACH ONE BROKE OPEN

Four different labs, four different systems, four completely different jobs. None of this is one lucky headline. It's the same shift showing up from four directions at once: finding software's flaws no longer requires a human sitting at a keyboard for weeks.

A quick note before starting. None of this research is mine. Credit belongs entirely to the researchers and teams named below. This article is my own plain-language summary of what they published, written so someone with zero background in computer security can follow every step and actually enjoy it, not a claim that any of the work is mine.

A couple of words worth defining up front, since they come up again and again below. A vulnerability is just a mistake in software that lets someone do something they shouldn't be able to do. A zero-day is a vulnerability nobody has caught yet, meaning defenders have had zero days to prepare for it. RCE, remote code execution, is the worst-case outcome: it means an attacker can make a computer run whatever commands they want, from anywhere in the world.

---

The one that broke in

• Earlier this month, a security researcher at a company called Searchlight Cyber tried something unusual. OpenAI had published the exact prompt it used to get one of its models to solve a genuinely hard, previously unsolved math problem. The researcher, Adam Kues, took that same prompt structure and pointed it at WordPress instead of math. WordPress is the software behind somewhere between four and four and a half out of every ten websites on the internet, so a serious flaw in it matters to an enormous number of people who have never even heard of it.
• He gave the model, called GPT-5.6 Sol Ultra, one job: read WordPress's own code from scratch, like an attacker with no inside knowledge would have to, and find a way in without a login. No shortcuts, no looking at old bug reports, no cheating by checking what had already been fixed elsewhere.
• Here's the plain version of what it found. Deep inside WordPress, a small mix-up let a visitor sneak their own instructions into a request to the site's database, without ever logging in. This kind of mistake has a name, SQL injection, and it's actually a very old, very well understood category of bug. The simplest version of the idea looks like this:

---

# the basic idea behind an SQL injection, simplified

query = "SELECT * FROM users WHERE id = " + visitor_input

# if visitor_input is supposed to be a plain number, like 5,
# the finished command reads:
#   SELECT * FROM users WHERE id = 5

# but nothing stops a visitor from sending this instead:
#   visitor_input = "5 OR 1=1"

# now the finished command actually reads:
#   SELECT * FROM users WHERE id = 5 OR 1=1

# "1=1" is always true, so instead of one user,
# the database hands back every single one

• That's the century-old idea. What the model actually found was a much better hidden version of it, buried in a feature most people have never heard of, and it took real cleverness to spot. From there it kept going for several more hours, using that same small crack to trick the site into briefly believing a fake instruction was really from an administrator, which let it create a genuine admin account out of thin air. From an admin account, uploading a file that runs whatever code you want is a single click.

• Total time the model spent building all of this, start to finish: a bit over ten hours. Total cost: about $25. Kues himself said plainly that he doesn't think a human researcher could have found and finished this exact chain in ten hours, and he's not sure it would even be possible in that timeframe if someone handed a researcher the first bug already discovered. The flaw now has a name, wp2shell, two official tracking numbers, and WordPress's security team took the unusual step of forcing the fix onto every affected site automatically, rather than waiting for individual site owners to update on their own.

---

The one that stopped an attack before it happened

• Not every AI in this story is trying to break in. Google runs a project called Big Sleep, built by two of its security teams together, Project Zero and DeepMind, and its entire purpose is the opposite: read code that hasn't shipped yet, or that's already out in the world, and find the flaws before anyone else does.
• Its very first success, in late 2024, was finding a bug in SQLite, a small but hugely important piece of software that quietly runs inside an enormous share of the world's apps, so common that most engineers who use it every day couldn't tell you it's there. The bug had slipped past Google's own automated bug-hunting tools for who knows how long. Big Sleep found it, it got fixed the same day, and it never reached a single real user.
• The second moment, less than a year later, is the more remarkable one. Google's team that tracks online threats noticed signs that unknown attackers were quietly getting ready to use some flaw in SQLite, somewhere, they just didn't know which one yet. That's normally a nightmare scenario for defenders, a countdown with no visible clock. They handed what little they knew to Big Sleep, and it worked out exactly which bug the attackers were about to use. Google patched it before a single attack happened. They called it the first documented time an AI agent has directly stopped a real attack that was already underway, not just found a bug sitting quietly in some code.

---

The one that quietly out-hacked every human on the leaderboard

• HackerOne is one of the biggest platforms in the world for what's called a bug bounty, a system where companies pay independent researchers real money to find flaws in their own software before criminals do. Thousands of skilled people compete on it every day, and there's a public leaderboard ranking the best of them.
• In June 2025, for the first time ever, the name at the very top of the US leaderboard wasn't a person. It was an autonomous system called XBOW, built by a small team that had only started working on it about a year and a half earlier. It got there by actually running against real companies' real, live systems for around five months, not practice puzzles.
• The most interesting part of how they pulled it off isn't really about how good the underlying model was at spotting problems, which the team said turned out to be the easier half. It's about honesty. AI models are notorious for confidently claiming things are broken when they aren't, so instead of trusting the model's word for it, XBOW built a completely separate system whose only job was double checking every single finding before it went anywhere near a human, to make sure it was a real, provable, exploitable problem. That discipline is what let 285 verified vulnerabilities carry it all the way to the top spot, a number that kept growing into the thousands over the following months.

---

The one where a government proved it works at scale

• The most official of the four by a wide margin. DARPA, the US defense research agency that helped fund the earliest version of the internet decades ago, spent two full years running a public competition called the AI Cyber Challenge. The task: build a fully autonomous system that can both find and actually fix security flaws in real software that runs things like power grids and hospitals, without a human doing the work. Anthropic, Google, Microsoft, and OpenAI all pitched in model access to help make it possible.
• Seven finalist teams from around the world showed up to compete at the DEF CON security conference in August 2025. Every single one of the seven found at least one real, previously unknown security flaw, 25 in total across the field, hiding in software that genuinely matters, things like the Linux operating system and the software that runs a huge share of websites. Close to half of those got automatically patched too, with the average team going from finding a bug to having a working fix in about 45 minutes. A team built from researchers at Georgia Tech and a few South Korean universities, called Team Atlanta, took first place.

• Afterward, DARPA released most of the winning systems to the public for free, specifically so that any company or open source project in the world could start using them immediately.

---

How much the safety window has actually shrunk

• Step back from the four individual stories and there's a number that ties them all together, one that security teams around the world watch closely: the time between a flaw becoming publicly known and someone actually using it to attack real systems. According to Mandiant, a major cybersecurity research firm, that window has fallen from more than 700 days in 2020 to just 44 days in 2025, a roughly sixteen-fold collapse in five years. Separate research from Palo Alto Networks found that once an attacker actually gets into a system today, the fastest quarter of them are stealing data within about 72 minutes, down from 285 minutes barely a year before.

• Put simply, the head start defenders used to be able to count on, weeks or months of quiet time between a bug being discovered and someone actually weaponizing it, has mostly disappeared. The four stories above are a meaningful part of why.

---

What's actually changing

• None of these four are lab demos against a target picked because it's easy. WordPress runs hundreds of millions of real websites. SQLite is quietly everywhere. HackerOne's leaderboard is thousands of genuinely skilled people competing for real money against real companies. DARPA's challenge used real critical infrastructure code, not made-up puzzles designed to be solvable. Every one of these was tested against the messy, high stakes, real version of the problem, and every one held up.
• What's different isn't that computers can now do something nobody imagined before. Automated tools have helped security researchers for decades already. What's different is how much less it now takes to get there. Work that used to require a specialist holding a dozen small, individually boring-looking details in their head all at once, for days or weeks at a time, now takes a matter of hours and costs about as much as a couple of pizzas, or seven separate teams all arrive at the same answer in the same single weekend, or a defender's early warning system quietly closes the door before an attacker ever gets to knock.
• The digital world isn't simply getting more dangerous, and it isn't simply getting safer either. It's getting faster on both sides of the fight at the exact same time, and the side that always used to have a little more breathing room, the defenders, is the one that just lost most of the cushion it was counting on. Whatever piece of software you're using right now without thinking twice about it, the honest expectation going forward is that finding out what's wrong with it, for better reasons or worse ones, costs less than it ever has.