AI Offense is Not Noclip Mode

This analysis argues that AI lowers the cost and persistence of vulnerability discovery and exploitation, using the wp2shell pre-authentication RCE in WordPress as a case study: a model-driven multi-agent run found a route-confusion bug chained into SQLi and escalation to admin code execution on default, internet-facing installs. The author emphasizes that AI changes attack economics (more cheap iteration and persistence) rather than magically bypassing well-enforced defenses, and recommends focusing on reducing anonymous exposure, enforcing phishing-resistant authentication, consistent enforcement of controls, segmentation, and patch prioritization based on exploitability.