Exploit Development, Agentic Vulnerability Discovery, and Fake PoCs

Key takeaways

• Spencer McIntyre draws a direct line between modern agent swarms and old distributed fuzz farms that scaled across 100 nodes to stress-test targets like Google Chrome. Read more →
• Formal verification programs run by proprietary AI vendors fail to unblock exploit development. VulnCheck director Spencer McIntyre notes that vetted researcher access rarely stops models from refusing basic vulnerability verification tasks. Read more →
• Data from VulnCheck's ThreatCon analysis shows that in 2026, the volume of broken or illegitimate public proof-of-concept (PoC) exploits crossed 50% for the first time. Read more →
• Malicious hackers historically held an open-ended schedule to construct zero-day exploits, while security teams had hours to respond once an incident began. Read more →
• McIntyre found that large language models write functional exploit code for open-source web bugs like token logic errors, expression language injection, and directory traversal leaks. Read more →
• Spencer McIntyre, Director of Exploit Development at VulnCheck, warns that automated models like Claude Opus 3.5 and GLM detect theoretical flaws without confirming if an exploit works. Read more →