Today's LLMs craft exploits from patches at lightning speed

The time from vulnerability disclosure to proof-of-concept (PoC) exploit code can now be as short as a few hours, thanks to generative AI models. Matthew Keely, of Platform Security and penetration testing firm ProDefense, managed to cobble together a working exploit for a critical vulnerability in Erlang's SSH library (CVE-2025-32433) in an afternoon, although the AI he used had some help - the model was able to use code from an already published patch in the library to hunt down which holes had been filled and figure out how to exploit them. Inspired by a post from another security firm, Horizon3.ai, about the ease with which exploit code for the SSH library bug could be developed, Keely wondered whether an AI model – in this case, OpenAI's GPT-4 and Anthopic's Claude Sonnet 3.7 – could craft an exploit for him. "Turns out — yeah, it kinda can," Keely explained. "GPT-4 not only understood the CVE description, but it also figured out what commit introduced the fix, compared that to the older code, found the diff, located the vuln, and even wrote a PoC. When it didn't work? It debugged it and fixed it too." It's not the first time AI has proven its mettle at not just finding security holes but also ways to exploit them. Google's OSS-Fuzz project has been using large language models (LLMs) to help find vulnerabilities. And computer scientists with University of Illinois Urbana-Champaign have shown that OpenAI's GPT-4 can exploit vulnerabilities by reading CVEs. But to see it d...