GPT5.6 and $25 Used to Find a $500K WordPress RCE
Original: Exploit brokers pay $500k for WordPress RCEs. I found one with GPT5.6 and $25
Why This Matters
Demonstrates that advanced AI models can now automate high-value zero-day vulnerability discovery at minimal cost.
Security researcher Adam Kues at Searchlight Cyber used OpenAI's GPT5.6 Sol Ultra model with a $25 API spend to discover a pre-authentication remote code execution (RCE) vulnerability in WordPress — the same class of exploit that brokers pay up to $500,000 for.
Searchlight Cyber researcher Adam Kues published findings on July 20, 2026, detailing how he used OpenAI's GPT5.6 Sol Ultra to discover a zero-day RCE vulnerability in WordPress for approximately $25 in API costs. Kues was inspired by OpenAI's published prompt used to solve the Cycle Double Cover mathematical conjecture, and adapted it for security research purposes. He directed four AI agents to analyze WordPress source code for at least six hours using that adapted prompt. The result was a pre-authentication to RCE exploit chain — a vulnerability class that exploit brokers list at up to $500,000. Searchlight Cyber delayed publication to allow defenders time to patch over the weekend. During that window, independent researchers Calif and Hacktron were able to reproduce the full exploit chain before public proof-of-concept code appeared on GitHub. The team also released a public testing tool at wp2shell.com to allow WordPress administrators to check if their installations are vulnerable.