Exploit Development, Agentic Vulnerability Discovery, and Fake PoCs
Spencer McIntyre, Director of Exploit Development at VulnCheck, joins hosts Daniel Whitenack and Chris Benson to discuss how AI is altering vulnerability research and exploit generation. They explore the critical distinction between discovering code flaws and proving attacker utility, the prevalence of broken and fake proof-of-concept exploits, and the friction caused by commercial AI guardrails on legitimate defensive security teams. McIntyre also outlines how agent swarms are accelerating vulnerability triage while human researchers remain essential for high-impact exploit verification.
- Spencer McIntyre draws a direct line between modern agent swarms and old distributed fuzz farms that scaled across 100 nodes to stress-test targets like Google Chrome. Read →
- Formal verification programs run by proprietary AI vendors fail to unblock exploit development. VulnCheck director Spencer McIntyre notes that vetted researcher access rarely stops models from refusing basic vulnerability verification tasks. Read →
- Data from VulnCheck's ThreatCon analysis shows that in 2026, the volume of broken or illegitimate public proof-of-concept (PoC) exploits crossed 50% for the first time. Read →
- Malicious hackers historically held an open-ended schedule to construct zero-day exploits, while security teams had hours to respond once an incident began. Read →
- McIntyre found that large language models write functional exploit code for open-source web bugs like token logic errors, expression language injection, and directory traversal leaks. Read →
- Spencer McIntyre, Director of Exploit Development at VulnCheck, warns that automated models like Claude Opus 3.5 and GLM detect theoretical flaws without confirming if an exploit works. Read →