In a recent experiment, Sean Heelan (a cybersecurity expert and researcher) decided to test how far modern artificial intelligence models can go in cybersecurity. He created agents based on Opus 4.5 and GPT-5.2 tasked with writing exploits for a zero-day vulnerability in the QuickJS JavaScript interpreter. He added various protections, such as address space randomization, non-executable memory, and a seccomp sandbox, and set objectives such as spawning a shell, writing a file, or connecting to a command-and-control server. The agents succeeded with more than 40 different exploits across six scenarios. GPT-5.2 completed them all, while Opus 4.5 completed all but two.
This experiment suggests that a time is approaching when the ability of a state or group to develop exploits, penetrate networks, escalate privileges, and maintain persistence will depend more on the number of tokens it can process than on the number of hackers it has. Sean Heelan emphasizes that it is better to prepare for such a future, even if it ultimately does not materialize, than to be caught off guard.
What did the agents accomplish in the experiment?
The agents turned the QuickJS vulnerability into a kind of interface (API) that allowed them to read and arbitrarily modify the target process's address space. Because it was a zero-day with no public exploits, they had to develop this capability themselves—by reading source code, debugging, and experimenting. For example, in one of the most difficult tasks, GPT-5.2 had to write a specified string to a file on disk while protections such as full RELRO, fine-grained CFI on the QuickJS binary, a hardware-enforced shadow stack, a seccomp sandbox preventing shell execution, and a version of QuickJS without functions for accessing the operating system or files were enabled.
The solution? The agent constructed a chain of seven function calls using glibc's exit-handler mechanism. The complete exploit can be found on GitHub, along with an explanation. It took the agent 50 million tokens and more than three hours, at a cost of around CZK 1,150 per run of a single agent (running four agents in parallel cost about CZK 3,450). Most tasks were solved within an hour and for less than CZK 700 using 30 million tokens with Opus 4.5.
An important caveat: QuickJS is much simpler than the interpreters in Chrome or Firefox—it has an order of magnitude less code and complexity. The exploits did not use new breakthroughs in bypassing protections, but rather known weaknesses also used by human exploit developers. Nevertheless, the complete exploit chains were new because the vulnerability was unknown—it was discovered by an agent based on Opus 4.5.
What does industrialization mean in cybersecurity?
By industrialization, Sean Heelan means a situation in which an organization's success depends on the number of tokens it can devote to a task. To achieve this, an agent needs an environment in which to search for solutions, tools, and a way to verify results without human intervention. Exploit development is an ideal use case: the environment is easy to set up, the tools are well known, and verification is straightforward. For example, to verify shell spawning, the validation system listens on a port, launches the interpreter, and sends a command—if a connection is established, the exploit works.
Some tasks involved in cyber intrusions are more complex because they require interaction with a real environment, where a mistake can end the entire operation—for example, through detection and removal from the network. This includes initial access, lateral movement within the network, maintaining access, or espionage. Here, it is not possible to explore everything offline; the agent must operate in a hostile environment with the risk of failure.
What stage are we currently at?
Even today, tokens can be exchanged for real results in vulnerability discovery and exploit development. OpenAI's Aardvark project shows that more tokens mean more bugs found and better quality. The same was true in Sean Heelan's experiments—the more difficult tasks required more tokens, but the limiting factor was the budget, not the models.
For other tasks, such as attack orchestration, there are reports of Chinese hackers using Anthropic's API. However, full automation after gaining access to a network is not yet common. One indicator may be the automation of site reliability engineering (SRE) work—if companies are selling agents for this purpose, similar models are likely capable of handling hacking tasks in hostile networks as well.
Sean Heelan is calling for better evaluations of models against real-world targets, such as the Linux kernel or Firefox, using zero-days. He recommends that researchers try tackling complex problems with as many tokens as possible and share their results. His code on GitHub may help.
