OpenAI's GPT-4 can exploit real vulnerabilities by reading security advisories

Researchers at UIUC demonstrated that GPT-4 agents, when connected to an automation framework and provided CVE descriptions, can autonomously exploit a majority of tested one-day vulnerabilities (87% success across 15 samples, 82% for CVEs disclosed after the model cutoff). The paper highlights that many tested bugs were rated high/critical, that exploitation can be inexpensive and automated, and warns that future models may further lower the barrier to large-scale exploitation despite no evidence of active in-the-wild abuse in this report.