Can you really find a zero-day vulnerability for $25?

Yes, in 2026, a case was reported where a zero-day RCE vulnerability in a WordPress plugin was discovered using the GPT-5 API at a cost of about $25. This was possible because the researcher leveraged the model's reasoning capabilities to quickly identify logical flaws in execution paths that would be difficult to find manually. Of course, this result combines AI analysis with human verification and the development of exploit code.

What makes LLM-based vulnerability scanning superior to traditional tools?

Traditional fuzzing and static analysis tools rely on predefined rules or input mutations, making it difficult to uncover contextual flaws in complex business logic. In contrast, LLMs, trained on vast amounts of code data, can understand the semantic context of code and generate explanations of "why" it is vulnerable. However, the potential for false positives due to model hallucinations remains a limitation.

How does AI vulnerability discovery change the way developers work?

Developers are no longer bogged down by repetitive pattern matching; they can focus on analyzing high-risk logic identified by AI and invest time in architectural-level improvements. The 'vibe coding' approach, where developers converse with AI to validate security flaws in real time like pair programming, is also spreading. This accelerates the overall Shift Left security strategy.

What are some representative defensive measures against AI-powered attacks?

A prime example is OpenAI's Daybreak program, expanded in June 2026. This initiative quickly delivers AI-discovered open-source vulnerabilities to maintainers and prioritizes patch support, helping defenders respond before attackers. At the government level, policy discussions are actively underway to control the offensive use of AI models.

What is the most important point when introducing AI into DevSecOps?

The most critical point is establishing a systematic human verification process for AI analysis results. Using platforms like md-log to collaboratively review analysis reports and manage an immutable history can enhance reliability. Additionally, considering model hallucination, a layered defense strategy that cross-validates results from multiple tools rather than relying on a single model's output is necessary.

Zero-Day Found with $25 and GPT: The Reality of AI-Driven Vulnerability Discovery

md-logJuly 21, 20266 min read

In recent years, AI has evolved beyond writing code to becoming a tool for finding code vulnerabilities. Particularly in 2026, reports of discovering critical remote code execution (RCE) vulnerabilities in live software using large language models (LLMs) like GPT at a cost of just $25 in API fees have drawn industry attention. Security research is no longer the exclusive domain of highly trained experts or well-equipped organizations. In this post, we analyze the paradigm shift brought by AI-driven vulnerability discovery and explore its profound impact on developers' daily security workflows and DevSecOps.

$25 Cost, Critical Outcome: Case Analysis

In early 2026, an independent security researcher applied iterative prompt engineering to the GPT-5 API and identified a zero-day RCE vulnerability in a widely-used WordPress plugin. He made API calls over about four hours, incurring a total cost of merely $25. This process was accomplished without traditional fuzzing tools or expensive static analysis solutions, relying solely on natural language instructions and the model's reasoning capabilities.

The researcher first described the plugin's function structure to GPT, then asked it to trace the path where user input was passed to file system operations. By asking questions as if conversing with an experienced code reviewer, he eventually pinpointed an unvalidated deserialization call site. This case vividly demonstrates that AI can understand the semantic context of code and infer logical errors in complex execution flows.

The Rise of AI-Powered Vulnerability Scanning: Beyond Fuzzing and Static Analysis

Traditional security tools are powerful but have clear limitations. Fuzzing triggers crashes with unexpected inputs but struggles to find flaws in complex business logic. Static analysis works pattern-based, leading to many false positives and a lack of contextual understanding. In contrast, LLMs, trained on vast code corpora, can contextually explain 'why' a piece of code is dangerous, much like a human expert.

However, their limitations are also clear. The model's hallucination phenomenon can fabricate plausible but non-existent vulnerabilities, and it may not promptly reflect the latest changes in libraries or frameworks. Thus, at present, LLMs are suitable for complementing existing tools and providing direction in the 'first look' phase of analysis, rather than completely replacing them. In fact, in June 2026, OpenAI significantly expanded its Daybreak program with the 'Patch the Planet' initiative to help open-source maintainers prioritize patches, acknowledging these limitations and emphasizing the importance of human validation of AI findings.

Evolving Developer Workflows: From Code Review to 'Vibe Coding'

AI-driven vulnerability scanning is fundamentally changing developers' daily security practices. It is now possible for AI to pre-scan all code changes during code review and point out potential security flaws. Developers no longer waste time searching for simple syntax errors or well-known vulnerability patterns; instead, they can focus on analyzing the root causes of high-risk logic suggested by AI and improving design.

Here, the concept of 'vibe coding' emerges. This is a development methodology where developers converse with AI to instantly validate the intent and flow of code. When AI flags a security vulnerability in real time, the developer can fix it immediately, as if talking to a pair-programming peer. This workflow elevates the 'Shift Left' strategy of integrating security early in the DevOps pipeline to a new level.

Democratization of Security Research and Its Dark Side

The rapidly lowering barrier to entry in security research thanks to AI is a double-edged sword. Small startups or independent developers can now have world-class vulnerability analysis capabilities, positively raising the overall security level of the software ecosystem. However, the same tools are equally available to malicious attackers. In late June 2026, the U.S. government temporarily blocked access to Anthropic's powerful AI model 'Mythos 5', indicating growing national security concerns over AI model capabilities.

In an era where anyone can hunt for zero-days at low cost, organizations must dramatically speed up their response. OpenAI's focus on patching vulnerabilities found through Daybreak can be seen as a counter-strategy. Ultimately, the key is not to control access to the AI tools themselves, but to build a robust ecosystem where discovered vulnerabilities are quickly patched.

Integrating AI into DevSecOps Pipelines: Practical Adoption Considerations

There are several important considerations when actually integrating AI-based vulnerability scanners into the DevSecOps pipeline. First, a validation process for AI analysis results is essential. Instead of manually responding to automated alerts, using a human-in-the-loop review platform like md-log allows team members to cross-validate AI-generated analysis reports and build an immutable history. Second, model selection and prompt engineering determine analysis accuracy. Rather than generic models, use models fine-tuned for specific security tasks like Daybreak, or build prompt chains that deliver detailed code context. Third, decide at which point in the CI/CD pipeline to deploy AI scanning. Combining pre-commit scans with periodic deep analysis is a cost-effective yet robust defense strategy.

In conclusion, AI's ability to find zero-days for just $25 is a wake-up call. This is no longer a distant future scenario but a vivid reality facing developers and security teams today. The important thing is not to attempt to block the use of AI tools, but to establish systems to operate and validate them responsibly. Complementing AI discoveries with human critical thinking and creating collaborative structures to quickly patch found vulnerabilities is more urgent than ever. In this changing landscape, how developers trust and control powerful AI assistants will determine the future of software security.

References

#AISecurity #ZeroDay #GPT5 #DevSecOps #VulnerabilityDiscovery

Frequently asked questions

Can you really find a zero-day vulnerability for $25?: Yes, in 2026, a case was reported where a zero-day RCE vulnerability in a WordPress plugin was discovered using the GPT-5 API at a cost of about $25. This was possible because the researcher leveraged the model's reasoning capabilities to quickly identify logical flaws in execution paths that would be difficult to find manually. Of course, this result combines AI analysis with human verification and the development of exploit code.
What makes LLM-based vulnerability scanning superior to traditional tools?: Traditional fuzzing and static analysis tools rely on predefined rules or input mutations, making it difficult to uncover contextual flaws in complex business logic. In contrast, LLMs, trained on vast amounts of code data, can understand the semantic context of code and generate explanations of "why" it is vulnerable. However, the potential for false positives due to model hallucinations remains a limitation.
How does AI vulnerability discovery change the way developers work?: Developers are no longer bogged down by repetitive pattern matching; they can focus on analyzing high-risk logic identified by AI and invest time in architectural-level improvements. The 'vibe coding' approach, where developers converse with AI to validate security flaws in real time like pair programming, is also spreading. This accelerates the overall Shift Left security strategy.
What are some representative defensive measures against AI-powered attacks?: A prime example is OpenAI's Daybreak program, expanded in June 2026. This initiative quickly delivers AI-discovered open-source vulnerabilities to maintainers and prioritizes patch support, helping defenders respond before attackers. At the government level, policy discussions are actively underway to control the offensive use of AI models.
What is the most important point when introducing AI into DevSecOps?: The most critical point is establishing a systematic human verification process for AI analysis results. Using platforms like md-log to collaboratively review analysis reports and manage an immutable history can enhance reliability. Additionally, considering model hallucination, a layered defense strategy that cross-validates results from multiple tools rather than relying on a single model's output is necessary.

← All posts