The practical takeaway first: AI-assisted vulnerability research is now cheap enough that a single researcher with an afternoon and a modest API budget can find flaws that previously required weeks of expensive manual auditing. A researcher at SLC proved this by identifying a remote code execution (RCE) bug in WordPress — the kind that exploit acquisition firms like Zerodium list at up to $500,000 — using roughly $25 of model API calls.
The workflow is methodical, not miraculous. The researcher fed WordPress core and plugin PHP source code into a GPT-4-class model and prompted it to flag dangerous function calls, unvalidated inputs, and logic chains that could lead to arbitrary code execution. The model served as a high-speed first-pass triage layer — surfacing candidate regions worth investigating — while the human researcher handled validation and proof-of-concept development. AI replaced the slow, mechanical grep-and-read phase; human judgment still closed the loop.
The cost compression here is what changes the landscape. A thorough manual audit of a codebase the size of WordPress and its plugin ecosystem typically runs weeks and tens of thousands of dollars in consultant time. Collapsing that to a few hours at negligible cost means serious vulnerability research is no longer gated by large budgets or institutional resources. That cuts both ways: defenders can run more frequent internal audits, but so can individual attackers who previously lacked the resources to compete with well-funded offensive teams.
If you maintain WordPress installations or publish plugins, update your threat model accordingly. The adversary is no longer only a nation-state or a large offensive security firm — it's anyone with domain knowledge and a few dollars of API credit. This makes patch cadence, rigorous input validation, and proactive static analysis more urgent, not optional.
To replicate this defensively on your own codebase, the approach is straightforward: use a code-aware LLM with prompts targeting dangerous PHP sinks — eval, exec, unserialize, fileputcontents — then trace backward from those sinks to any point where user-controlled data enters. Treat model output as a hypothesis list, verify every candidate manually, and expect the efficiency gain to hold even as token costs scale with codebase size.
The researcher followed responsible disclosure practices and reported the flaw through proper channels before publishing. That discipline matters more now, not less. Lower discovery costs mean more researchers — and more bugs surfacing faster. If you're doing this kind of work, treat coordinated disclosure as a required step in the process, not an afterthought.