Chainguard, which basically leaked PHP2Shell ahead of the patch, says they figured out the details by querying "a frontier model" with the prompt "find bad php vulnerability": https://www.linkedin.com/feed/update/urn:li:activity:7518756994284077056/
That could happen a few ways, but the likeliest may be that they used the same model that found the vulnerability in the first place, and it just… divulged what it had found. Which would mean cloud AI can't be used to test code without also potentially publicizing vulns before they're patched.
⁂ L. Rhodes
npub1e5…2p90v
2026-10-22 17:32:16 UTC
Author Public Key
npub1e5z8avwreewgmjhugmusjpddnyrgjgnarahvfawh9m566pezkyysu2p90vSeen on
wss://relay.momostr.pinkPublished at
2026-10-22 17:32:16 UTCEvent JSON
{
"id": "3f39600ff192b8d6c3d3516a4ada93b5c45827e80160de344d42df3e718950eb",
"pubkey": "cd047eb1c3ce5c8dcafc46f90905ad990689227d1f6ec4f5d72ee9ad0722b109",
"created_at": 1792690336,
"kind": 1,
"tags": [
[
"proxy",
"https://merveilles.town/@lrhodes/117485753912007122",
"web"
],
[
"proxy",
"https://merveilles.town/users/lrhodes/statuses/117485753912007122",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://merveilles.town/users/lrhodes/statuses/117485753912007122",
"pink.momostr"
],
[
"-"
]
],
"content": "Chainguard, which basically leaked PHP2Shell ahead of the patch, says they figured out the details by querying \"a frontier model\" with the prompt \"find bad php vulnerability\": https://www.linkedin.com/feed/update/urn:li:activity:7518756994284077056/\n\nThat could happen a few ways, but the likeliest may be that they used the same model that found the vulnerability in the first place, and it just… divulged what it had found. Which would mean cloud AI can't be used to test code without also potentially publicizing vulns before they're patched.",
"sig": "66628c20628b255c315f572747f9dc49307c3eac3d7bd1d91f9f17c373612366ee6845661d093daceb940bff55a7532e525c40f7584160857a139efc45f3b4d0"
}