Key Points

The post argues that frontier AI coding agents will soon dramatically change vulnerability research by making exploit discovery faster and cheaper, potentially within months rather than years.
It claims LLM agents are especially well-suited to exploitation because they already encode broad correlations from training data, recognize common bug classes, and can perform extensive automated search.
The article suggests that substantial high-impact vulnerabilities may be found by having an agent analyze a source tree and then direct it to identify “zero days,” turning research into an agentic workflow.
It explains that exploit development is a good match for LLM strengths: pattern matching plus constraint/reachability reasoning with objective success/failure testing that allows continuous, non-bored searching.
The author notes the perspective was influenced by a Security Cryptography Whatever podcast episode featuring Anthropic’s Nicholas Carlini.

Simon Willison’s Weblog

Sponsored by: WorkOS — Production-ready APIs for auth and access control, so you can ship faster.

3rd April 2026 - Link Blog

Vulnerability Research Is Cooked. Thomas Ptacek's take on the sudden and enormous impact the latest frontier models are having on the field of vulnerability research.

Within the next few months, coding agents will drastically alter both the practice and the economics of exploit development. Frontier model improvement won’t be a slow burn, but rather a step function. Substantial amounts of high-impact vulnerability research (maybe even most of it) will happen simply by pointing an agent at a source tree and typing “find me zero days”.

Why are agents so good at this? A combination of baked-in knowledge, pattern matching ability and brute force:

You can't design a better problem for an LLM agent than exploitation research.

Before you feed it a single token of context, a frontier LLM already encodes supernatural amounts of correlation across vast bodies of source code. Is the Linux KVM hypervisor connected to the hrtimer subsystem, workqueue, or perf_event? The model knows.

Also baked into those model weights: the complete library of documented "bug classes" on which all exploit development builds: stale pointers, integer mishandling, type confusion, allocator grooming, and all the known ways of promoting a wild write to a controlled 64-bit read/write in Firefox.

Vulnerabilities are found by pattern-matching bug classes and constraint-solving for reachability and exploitability. Precisely the implicit search problems that LLMs are most gifted at solving. Exploit outcomes are straightforwardly testable success/failure trials. An agent never gets bored and will search forever if you tell it to.

The article was partly inspired by this episode of the Security Cryptography Whatever podcast, where David Adrian, Deirdre Connolly, and Thomas interviewed Anthropic's Nicholas Carlini for 1 hour 16 minutes.

I just started a new tag here for ai-security-research - it's up to 11 posts already.

Posted 3rd April 2026 at 11:59 pm