AI Agents Are Now Finding Real Vulnerabilities on Their Own
Buried in the disclosure details of a WordPress login-screen vulnerability patched in August 2026 is a detail worth more attention than it got: the flaw, CVE-2026-64638, wasn't found by a human security researcher poking at the code. It was found by a research group called pwn.ai, using open-source models in a multi-agent workflow, with no human directing the search toward that specific bug.
What actually happened
The vulnerability — nicknamed XSS2Shell — is a reflected cross-site scripting flaw in how the login page's redirect parameter gets sanitized, serious enough to chain into full PHP code execution under the right conditions, and serious enough to be backported across every maintained WordPress release going back to version 4.7. That's not a toy finding. It's the kind of result that, a few years ago, would have come from a specialist spending days reading unfamiliar code by hand.
Why this is a bigger deal than one CVE
Automated vulnerability-finding tools aren't new — fuzzers and static analyzers have existed for decades. What's different here is an agentic workflow reading and reasoning about real, messy, widely-deployed production code the way a researcher would, not just pattern-matching against known bug signatures. If that generalizes, the economics of finding this class of vulnerability shift substantially: what used to require scarce, expensive specialist time becomes something that scales with compute instead.
The uncomfortable part
This cuts both ways, and anyone writing about it honestly has to say so. The same capability that lets a defender's team find and responsibly disclose a bug before it's exploited lets an attacker find the same bug and use it immediately. Nothing about an autonomous agent enforces responsible disclosure — that was a choice this particular team made. The gap between "found by AI" and "exploited by AI" is a policy and ethics question, not a technical one, and it's going to come up again.
Why we're paying attention
We spend our time thinking about a much narrower question — what evidence a shipped web page leaves behind about the tool that built it — but it's the same underlying shift: AI moving from a tool a person actively directs to something that operates with real autonomy over a task a person used to have to do directly, whether that's writing a page or auditing one for bugs. We wrote more about the first half of that shift, how AI builders fingerprint the pages they generate, in how we built this detector.
Sources: Wiz vulnerability database and coverage of the WordPress 7.0.3 release. Reporting on the exact discovery methodology varies in detail between outlets — treat the specifics as what's publicly reported, not independently verified by us.
Curious what we can and can't detect about how a page was built? Read the methodology, or try the detector.