We built a vulnerability vending machine: AI tokens in, zero-days out

Researchers at Intruder built an automated system using LLMs (large language models, AI systems trained on text data) to find real security vulnerabilities in software code, discovering a SQL injection zero-day (a previously unknown security flaw) in a WordPress plugin with 300,000+ users. The key challenge is that pointing an LLM at an entire codebase causes it to lose focus by processing irrelevant code, so they developed a pipeline using program slicing (a technique that extracts only the relevant code segments) combined with code scanning tools to give the LLM focused context and filter findings through multiple AI models before attempting exploitation.