Intruder's AI 'vulnerability vending machine' finds a WordPress zero-day on its own

Key points

• Intruder, a UK-based security company, has built an automated system that pairs large language models with code-analysis techniques to hunt for software flaws.
• The system found a previously unknown vulnerability, known as a zero-day, in a WordPress plugin and produced a working exploit without human help.
• Intruder says further discoveries from the same pipeline are already going through responsible disclosure to affected vendors.
• The project, first reported by BleepingComputer, hints at a shift where AI agents scale up bug-hunting work that used to need skilled researchers.
• WordPress site owners should keep plugins updated automatically and remove any plugin they are not actively using.

Intruder has been quietly building something the rest of the security industry will want to poke at. The company calls it a "vulnerability vending machine": you feed it AI tokens, and out come zero-days. A zero-day is a flaw the maker doesn't yet know about, which means there's no patch when attackers find it first.

The framing sounds like marketing copy. Intruder's evidence is a real bug in a real WordPress plugin that its system found and exploited without a human in the loop.

How does an AI actually find a zero-day?

The system combines two ideas that have existed separately for years. Code slicing pulls out only the parts of a program that handle a particular piece of data, letting a reviewer trace the path from user input to something dangerous, such as a database query or a file write. A large language model, the same kind of AI that powers chatbots, then reasons about that narrow slice rather than an entire codebase.

On its own, an LLM is a poor bug hunter. It hallucinates, inventing functions that don't exist or confidently reporting flaws that aren't there. Intruder's approach cuts the AI's field of vision down to one specific data flow. When the model flags something, the system tries to build a working exploit to prove it. If the exploit fires, the finding is real; if it doesn't, the report is discarded. That check kills most of the false alarms LLMs are known for.

What did it actually find?

Intruder says the pipeline discovered a previously unknown vulnerability in a WordPress plugin and generated a working proof-of-concept exploit. The plugin vendor is working through the standard responsible disclosure process, where researchers give the maker time to patch before details go public. More bugs from the same system are already in the disclosure queue with other vendors.

No CVE identifier, the industry's standard tracking number for a named flaw, has been published yet. Once a patch ships, expect one to appear on the official registry.

Why this matters beyond one plugin

WordPress runs a large share of the world's websites, and its plugin ecosystem is where most of its security problems live. Small plugins, written by hobbyists, rarely get professional code review. An AI that reviews them at scale changes the calculation for both defenders and attackers. We've covered the pace of zero-day discovery closely this year: our 14 July report on the Progress ShareFile emergency shutdown showed how quickly an unpatched flaw moves from discovery to active exploitation.

The uncomfortable part: the same approach works for whoever runs it. Intruder is a defensive company disclosing responsibly. A criminal group with budget for AI tokens can build something similar and skip the disclosure step entirely.

Expect more of these announcements through 2025. Google's Project Zero and others have published early results with related techniques. The vending-machine framing is new. The direction isn't.

Should you worry?

If you run a WordPress site, turn on automatic updates for both WordPress core and every plugin. Delete plugins you installed once and forgot; a disabled plugin can still be exploitable. Keep a backup stored somewhere the site itself can't reach.

None of that is new advice. It's about to matter more.