Notifications
Clear all
Topic starter
18/08/2026 2:52 pm
TL;DR: Pre-Mythos models still enable end-to-end exploit development, according to Intruder, after its engineer used a token-driven workflow to find a SQL injection flaw affecting 300,000-plus sites, and says the practical constraint is operator skill rather than model availability. The lesson for defenders is that AI-assisted attack capability is already present, so exposure reduction and patch speed matter more than debating model bans.
NHIMG editorial — based on content published by Intruder: LLMjacking, AI hacking tools, and the month in security research
By the numbers:
- 200 WordPress plugins and the first exploit it, ordPress plugins and the first exploit it produced was CVE-2026-3985 on more than 300,000 sites.
- Intruder says AI-powered checks made up 90% of the new detections it shipped in its first month of building them.
Questions worth separating out
Q: How should security teams respond when AI can generate exploit chains from dormant vulnerabilities?
A: Security teams should stop treating exploitability as a human bottleneck and start proving whether a flaw is reachable in their own environment.
Q: Why do exposed service keys become more dangerous when AI features are added?
A: Because the key remains easy to reuse while the service it unlocks becomes more valuable and more expensive to abuse.
Q: What do security teams get wrong about banning AI models?
A: They often treat model access as the main control, when the real risk is the attack workflow.
Practitioner guidance
- Prioritise internet-facing services with exploitable code paths Build a patch queue around services that expose deterministic flaws such as SQL injection, command injection, and auth bypass, then validate fixes with live exploit testing.
- Map exposed services to the identities they can reach For each externally reachable application or API, identify the service accounts, API keys, and backend roles it can access so compromise paths are visible before attackers test them.
- Shorten revocation windows for non-human credentials Rotate and revoke API keys, tokens, and certificates that are tied to internet-facing workloads as soon as they are suspected to be exposed, with ownership assigned in advance.
What's in the full article
Intruder's full analysis covers the operational detail this post intentionally leaves for the source:
- A step-by-step walkthrough of how the 0-day vending machine chained scanning, reasoning, and proof-of-concept generation.
- The specific WordPress plugin analysis that led to CVE-2026-3985 on more than 300,000 sites.
- Intruder's own breakdown of what AI-powered checks are detecting and how the coverage is changing.
- The wider commentary from its security team on model restrictions, attacker capability, and midmarket patching realities.
👉 Read Intruder's analysis of AI-assisted 0-day discovery and NHI abuse →
AI hacking tools and 0-day discovery: what practitioners should notice?
Explore further
18/08/2026 3:36 pm
AI-assisted offence is now a workflow problem, not a model problem. The article shows that the offensive value lies in chaining tools, reasoning, and execution, not in any single model release. That means the market conversation should shift from model bans to control points around exposure, privilege, and validation speed. For security teams, the useful question is whether their environment can withstand an attacker who iterates faster than a human analyst.
A few things that frame the scale:
- 98% of companies plan to deploy even more AI agents within the next 12 months, despite documented rogue behaviour in 80% of current deployments, according to AI Agents: The New Attack Surface report.
- Only 52% of companies can track and audit the data their AI agents access, leaving 48% with a complete blind spot for compliance and breach investigation.
A question worth separating out:
Q: Who should own response when AI-assisted exploitation hits internet-facing applications?
A: Application security, infrastructure, and identity teams should share ownership, because the fix spans patching, asset exposure, and credential containment. If the exploited service can reach sensitive backend roles, privileged access and non-human identity owners need to be in the containment chain immediately.
👉 Read our full editorial: AI hacking tools still matter because skilled operators do more with them
