We built a vulnerability vending machine: AI tokens in, zero-days out

Intruder describes a pipeline that uses Joern-based program slicing and LLM agents to triage and automatically exploit code slices; the system discovered a blind SQL injection (CVE-2026-3985) in the widely used Creative Mail WordPress plugin that can expose database contents (including admin hashes and tokens) when WooCommerce is present, and the plugin has been removed pending remediation.