A security researcher used GPT-5.6 Sol Ultra to find a Remote Code Execution (RCE) vulnerability in WordPress, from pre-authentication all the way to full server control. Exploit brokers pay up to $500,000 for an RCE on WordPress. The compute cost to find it with AI: $25.

Adam Kues, researcher at Searchlight Cyber, took the prompt that OpenAI had published for solving the Cycle Double Cover Conjecture with GPT-5.6 Sol (as we reported on July 12: /en/radar/gpt-5-6-sol-ultra-cyclic-polytope-conjecture) and adapted it for vulnerability research. He fed the model WordPress source code, four parallel sub-agents, and six hours of runtime. The instruction was explicit: find a chain from anonymous access to code execution, analyzing the code from first principles, without comparing patches or using git history.

Why this matters to you. Offensive security was one of the fields where human expertise and the cost of hiring an expert formed a barrier to entry. If a frontier model with a good prompt and $25 in compute can find critical vulnerabilities in software used by millions of sites, that barrier shrinks. For infrastructure teams, the message is clear: the window between disclosure and patching gets tighter. Updating WordPress and its dependencies isn’t something you can put off.

The researcher published a tool, wp2shell.com, to check if your WordPress instance is vulnerable. Two independent teams reproduced the entire exploit chain before other PoCs appeared on GitHub.

The Details

The prompt Kues adapted is worth examining closely because it’s a structured research framework, not just a casual “find the bug.” The instructions tell the model to maintain a diverse portfolio of approaches (input parsing, charsets, file uploads, error handling, serialization, race conditions, cryptography), explicitly track families of approaches, prevent all agents from converging on the same idea, and use adversarial agents to verify each candidate bug. The root agent synthesizes, challenges, and escalates across rounds.

The structure mirrors what we’ve seen work in GPT-5.6 Sol’s parallel reasoning experiments: the value lies in the control loop orchestrating around the model (as we noted on July 18: /en/radar/gpt-5-6-sol-convex-optimization-parallel-agents), not in the raw power of the model alone.

What changes in practice. A pre-auth RCE in WordPress is one of the highest-paid vulnerabilities in the exploit market, because WordPress powers over 40% of the web. Finding one used to require weeks of work from an expert researcher with deep knowledge of the codebase and ecosystem. Here the cost dropped to $25 in API usage and six hours of execution time. The prompt organizes a systematic search, and the model executes it with enough reasoning capacity to find a real chain.

How much to trust this. The researcher is a seasoned professional: he chose the target, set up the environment, adapted the prompt. We don’t know if the same approach works on arbitrary targets or smaller codebases. WordPress is a massive project with many attack surfaces, which paradoxically helps: more code means more paths to explore. Reproducibility is partially confirmed: two independent teams replicated the chain before other PoCs hit GitHub. We lack details on success rates against other software.

The bigger picture. The prompt demonstrates a pattern relevant to anyone outside security too: take a reasoning framework proven on one hard domain (mathematics), transfer it to another hard domain (bug hunting), and it works. The lesson for those using AI in their fields is that prompt architecture (with multi-agent systems, forced diversification, and adversarial verification) matters more than the naked model. The model is raw material; the prompt is the process.