The Illusion of a Lock – How AI is changing the speed and scale of hands-on WordPress vulnerability research.

Summary

In May 2026, OpenAI's internal AI research models, designed to test cybersecurity benchmarks, exploited a vulnerability in an Artifactory server to communicate and share findings. The agents eventually found a path to the internet via Hugging Face, where they executed approximately 17,600 actions over four and a half days, demonstrating rapid testing of vulnerabilities and lateral movement techniques.

Full text

2026: the year the tools learned to hackIn May 2026, OpenAI began testing an internal research model against a cybersecurity benchmark called ExploitGym. While the test environment was not supposed to have access to the open internet, there was, however, one narrow path out because the agents still needed a way to install software: an internally hosted Artifactory server that acted as a cache for package downloads. That pathway turned out to be enough for the model’s agents to eventually circumvent the test’s rules and escape confinement.On May 26, according to details OpenAI later presented at Black Hat, one of the agents found a previously unknown way through Artifactory. After initially exploiting this vector, it left information about what it found behind for the next agent. Other agents found the note and began leaving their own, until the shared package repository had effectively become a message board where agents exchanged vulnerabilities and divided up work. In early July, they hit Artifactory hard enough to knock the service over, leading to OpenAI’s investigation. They cleared the board, fixed the path the agents had found, and resumed testing, but two days later, the agents rebuilt the message board using a different method and continued their escape plan.The next stage of the process is what made headlines: the agents found a path to the internet and eventually reached Hugging Face, the largest public host of AI models and datasets. Hugging Face later reconstructed about 17,600 actions across a four-and-a-half-day campaign and determined that an agent found an outside code-running service it could use as a launch point. From this initial foothold, the agent exploited a data processing bug to read local files, leading it to discover a template injection bug to run Python inside a production worker to gain code execution. From there, it followed a fairly normal post-compromise sequence: steal credentials, map Kubernetes permissions, query cloud metadata, move laterally, and keep testing paths until enough of them worked.The unusual part of the incident was the volume and persistence of the attempts, and the fact that the agents would keep trying different approaches until something worked. Most of the roughly 17,600 actions Hugging Face reconstructed were unsuccessful, but those failures did not slow the process down very much because an agent could simply move on to another approach, start again in a fresh environment, return to an earlier idea, or build on something another agent had already discovered. The vulnerabilities themselves were mostly familiar types of security problems, but the agents were able to test far more possibilities and do it much faster than a human team realistically could. This speed and scale also helps explain why describing the incident as an AI that “escaped a sandbox” can be misleading. The sandbox itself did not have a direct connection to the internet, but it relied on a package service that did, and the agents were able to exploit a vulnerability in that service to get around the restriction. The security control was technically in place, but one of the systems allowed to cross its boundary still provided a path to the outside, showing that isolation only works when every service connected to the environment is treated as part of the same security boundary.The capabilities of these models have continued advancing as well. On August 7, OpenAI announced that an upcoming model called Astra had become capable enough that the company could no longer rule out it reaching its “Critical” cybersecurity threshold. OpenAI defines that level as the ability to develop zero-day exploits against hardened real-world systems or carry out an unfamiliar attack from a high-level objective through completion without a person directing each step. GPT-5.6 Sol, which was one of the models used in the Hugging Face evaluation, is currently rated one level below that at “High.” Astra was not involved in the Hugging Face incident, but its capabilities show how quickly the technology has continued progressing since then.Anthropic has been seeing the same trend from a different side of cybersecurity research. Through an initiative called Project Glasswing, the company gave access to its top model (at the time), Claude Mythos Preview, to roughly fifty organizations responsible for important consumer and business software for testing. Anthropic has reported that, as a result, the program identified more than 10,000 high or critical severity vulnerabilities during its initial phase. Access is now being expanded to roughly 150 additional organizations. Claude Mythos and Project Glasswing have marked an important shift, in that Anthropic says vulnerability discovery has become fast enough that triage and remediation are increasingly the bottleneck.The experiment I ran operated on a much smaller scale than the research programs conducted by OpenAI and Anthropic, but that also helped define the methodology. I kept the investigation under human control and built a sealed offline lab. The rule throughout the project was that AI could flag suspicious code and suggest possible vulnerabilities, while my job was to independently reproduce anything that was flagged before treating it as a finding.For the AI-assisted portion of the research, I used Claude Opus 4.8. Anthropic has since released more capable fifth-generation models, including Fable 5 and Opus 5, but those models also introduced stronger cybersecurity safeguards. Opus 5 can still perform source-code vulnerability analysis, although Anthropic blocks some categories of security work, including penetration testing and exploit generation, and automatically routes flagged requests back to Opus 4.8. Fable 5 is even more restrictive, and refuses to work on anything related to cybersecurity. Opus 4.8 was therefore a good fit for this project because it could review plugins containing tens of thousands of lines of code, map important entry points and data flows, and help identify areas that deserved closer inspection without the newer rules interrupting legitimate parts of the research.The research also focused on a part of the WordPress ecosystem that receives much less attention than major plugins such as Yoast or WooCommerce. Many sites rely on smaller plugins maintained by only one or a few developers. Some of these plugins are installed on thousands of sites, and sometimes left without significant updates for years. These plugins can still handle sensitive data and control important website functions while receiving far less time spent on security review.I reviewed dozens of these plugins inside my isolated lab, looking specifically for vulnerabilities that had not already been reported. The most common failures involved ordinary security controls that looked correct in the source and broke under testing.In some cases, a sanitizer simply returned the original input unchanged. In others, an authorization check confirmed that a user belonged to a group but never verified ownership of the specific object being requested. The illusion of a security control was there, but the protection itself was incomplete or not fully implemented.This article focuses on those kinds of failures and on the process I used to identify and verify them. It explains how the lab was designed, how plugins were selected, how AI assisted with the analysis, and how suspicious code was separated from vulnerabilities that could actually be reproduced. The specific plugins and proof-of-concepts are reserved for Part 2, after maintainers have had an opportunity to fix the affected software.A Controlled Two-Site EnvironmentThe method depends on being able to separate behavior caused by the plugin from behavior that would have happened anyway. If I cannot make that distinction, then the result is not reliable enough to count as a finding.To do that, I built two WordPress sites that are nearly identical except for one intenti

Entities