Loading story…
Aikido Security published a benchmark of 13 AI models measuring their ability to rediscover 26 known vulnerabilities from the GitHub Advisory Database using an AI code analysis harness aimed directly at vulnerable code snippets. GPT-5.6 posted the highest pooled recall, finding 23 of 26 CVEs, followed by grok-4.5 with 20, while Claude Opus variants scored between 15 and 18 and GLM-5.2 reached 16. Across the test set, all models consistently identified the obvious critical cases, showing that short and recognizable exploit paths remain easier for current models to detect.
The biggest gaps appeared on higher- and medium-severity flaws that required deeper reasoning across indirect code paths or missing validation checks, including complex chains such as SQL injection tied to unescaped ORM column aliases. The evaluation also highlighted significant run-to-run variance and found that pooling repeated runs of cheaper mid-tier models, such as pass@3 testing, often matched or exceeded the value of a single run from more expensive flagship reasoning tiers at substantially lower cost, suggesting that benchmarking methodology and harness design materially influence reported vulnerability-detection performance.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
On July 16, 2026, Aikido Security published research benchmarking 13 AI models on rediscovering 26 known vulnerabilities from the GitHub Advisory Database using its AI Code Analysis harness. The study reported GPT-5.6 with the highest pooled recall at 23 of 26 CVEs and highlighted cost-performance tradeoffs, including repeated runs of cheaper models outperforming some single runs of flagship models.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Anthropic published **Exploit Evals**, a framework for measuring whether advanced AI systems can carry out offensive cybersecurity tasks, as attention shifts from simple vulnerability identification to practical exploitation capability. The work highlights testing focused on realistic exploit-development steps and reflects growing concern that frontier models may increasingly assist with planning, chaining actions, and executing multi-stage attacks against software flaws. Separate benchmark results presented by Bugcrowd in **ExploitBench** found Anthropic’s **Claude Mythos** outperforming OpenAI’s **GPT-5.5** on exploitation tasks involving Google Chrome **V8** vulnerabilities. According to the reported results, Mythos averaged **9.90/16** and reached the highest exploitation tier on **21 of 41** vulnerabilities, while GPT-5.5 averaged **5.51/16** and reached that tier in **two** cases; researchers and industry experts said the findings suggest AI models are becoming more effective in offensive workflows and increase pressure on defenders to accelerate AI-assisted remediation, prioritization, and rapid patching.
Aug 11, 2026
OpenAI has released GPT-5.2-Codex, a new AI model designed to enhance agentic coding and cybersecurity tasks, with notable improvements in vulnerability detection and software engineering workflows. The model demonstrates superior performance on benchmarks such as SWE-Bench Pro and Terminal-Bench 2.0, and excels in professional Capture-the-Flag challenges, supporting advanced tasks like fuzzing, attack surface analysis, and test environment setup. OpenAI has implemented stronger safeguards to mitigate dual-use risks and is offering the model to paid ChatGPT Codex users, with an invite-only pilot for vetted cybersecurity professionals focused on defensive applications. The model's capabilities have already contributed to the discovery of several critical vulnerabilities in React Server Components, including CVE-2025-55182 (RCE), CVE-2025-55183 (source code exposure), and CVE-2025-67779 (DoS), prompting urgent patching recommendations. Industry research highlights both the promise and risks of AI-generated code, with studies showing that machine-written pull requests contain significantly more bugs and security vulnerabilities than those authored solely by humans. Issues such as improper password handling, insecure object references, and cross-site scripting are notably more prevalent in AI-generated code, raising concerns about the security implications of rapid AI-driven development. These findings underscore the importance of robust review processes and the need for continued vigilance as AI tools become more deeply integrated into software engineering and cybersecurity operations.
Jun 29, 2026
Security researchers and AI vendors reported rapid progress in applying frontier models to offensive and defensive cybersecurity work, including the discovery of **`CVE-2025-37899`**, a remote zero-day in the Linux kernel’s SMB implementation. A published account described using an advanced model to help identify the flaw, while OpenAI's **Daybreak** and Anthropic's **Project Glasswing** highlighted broader efforts to build AI systems for cyber operations, vulnerability research, and security workflows. SentinelLABS added evidence that these systems are moving beyond isolated tasks into sustained investigations, describing an eight-stage benchmark based on reverse engineering **fast16**, a 2005 Windows sabotage toolkit tied to interference with high-precision solvers used in nuclear-weapons modeling. In that evaluation, **GPT-5.6 Sol** was reported as the only publicly available model tested that completed the full long-horizon malware-analysis workflow, while other models showed useful point-in-time reasoning but failed to maintain consistency as new evidence forced earlier conclusions to be revised.
Jul 29, 2026