• 1 min read

We built a vulnerability vending machine: AI tokens in, zero-days out

Intruder built an AI-powered "vulnerability vending machine" that combines code slicing with LLMs to automatically discover complex software vulnerabilities. The company explains how the system found and exploited a previously unknown Wo…

What happened

Recent reporting highlighted we built a vulnerability vending machine: ai tokens in, zero-days out. AI is changing how vulnerability research gets done, but most of the conversation is still theoretical: what a model might eventually be capable of, rather than what it can actually find today. We wanted to answer a more practical question: using the models already available to us right now, how far can AI take us in finding real, exploitable vulnerabilities in production software?

Why it matters

This matters because AI-related risk increasingly shows up through deployment choices, interfaces, and governance gaps rather than model headlines alone. It is a direct signal about how compliance and policy expectations are being translated into implementation work.

Assessment

The strongest signal here is that a vulnerability class or attack path is being treated as operationally relevant rather than background technical debt. In practice, that means operators should read this as a broader signal over noise item rather than a narrow one-off.

  • Review whether the issue, advisory, or attack pattern is relevant to your environment, suppliers, or exposed systems
  • Patch, harden, or validate logging and monitoring coverage where applicable
  • Translate the development into specific ownership, policy, and evidence requirements instead of leaving it as background policy tracking
  • Monitor follow-on reporting or primary-source updates for scope expansion, implementation guidance, or stronger enforcement signals

Further reading