What's this about?
A security researcher at Searchlight Cyber adapted the exact prompt OpenAI published for GPT-5.6 Sol Ultra's proof of the Cycle Double Cover conjecture, retargeted it at WordPress's source code, and told it to run up to 4 parallel agents for at least 6 hours hunting for a pre-authentication remote-code-execution chain. The model found a genuine pre-auth SQL injection — the first meaningful one in WordPress this decade — then, four hours later, worked out how to escalate it to full admin takeover without cracking any passwords. Total cost: about $25 of a $200/month subscription, against a software base of roughly 500 million sites and a reported $500,000 broker price for exploits like it.
What exactly is a "pre-auth RCE"?
RCE (remote code execution) means an attacker can run arbitrary commands on a target server from across the network. "Pre-auth" is the scary modifier: it means the attacker doesn't need a valid login first — anyone who can reach the website can trigger it. The chain here started as a SQL injection (tricking the database into leaking data it shouldn't, like an admin's password-reset token) and was escalated step by step into full control, the kind of vulnerability that historically took skilled human researchers weeks to find in software as heavily audited as WordPress.
What's the community saying?
- Awe at the capability jump — top comments compare it to chess engines becoming superhuman decades ago: "I guess they are superhuman at understanding code now as well." One commenter who has independently gotten models to build container breakouts says this tracks with what they're seeing in offensive security work.
- Who deserves the credit (and the bounty)? — a sharp disagreement over whether crediting the human who wrote the prompt, rather than the model that found the bug, is fair, with one camp arguing people who use LLMs to find exploits "should never get a reward or credit."
- Skepticism about the $500k number — several commenters note there's no evidence the bounty was actually paid, and point out the author works at a company (Assetnote) that sells AI-powered security scanning — a possible commercial incentive to hype the finding.
- Guardrail surprise — commenters who've tried similar things note GPT-5.5 and up, and Claude Opus 4.7+, usually refuse offensive-security prompts, so several are surprised this one wasn't blocked despite explicitly asking for a working RCE chain.
- "Who even needs WordPress anymore?" — a tangent about whether WordPress's ubiquity (and resulting attack surface) still makes sense in an era of static site generators and AI-assisted custom builds.