AI-Driven Security Project Publishes Full Analyses of 10 Critical 0-Day Vulnerabilities with Working Exploits
Key Takeaways
- ▸Multi-LLM ensemble (Claude, GPT, DeepSeek, GLM) discovered 10 critical zero-days in first batch, demonstrating AI's capability for complex vulnerability research
- ▸Project publishes full technical analyses with working exploits and reproduction steps—a "full disclosure" model without apparent vendor coordination
- ▸Vulnerabilities affect critical enterprise and infrastructure software; majority are unauthenticated RCE with CVSS scores of 9.8
Summary
A security research project called '0day Rubbish' has begun publishing comprehensive technical analyses of zero-day vulnerabilities discovered through an AI-driven ensemble combining Claude (Anthropic), OpenAI's GPT models, DeepSeek, and GLM. The inaugural batch covers 10 previously undisclosed vulnerabilities across eight enterprise products—including InterSystems IRIS, Brekeke SIP Server, Acumatica ERP, and AdRem NetCrunch—with CVSS scores ranging from 7.3 to 9.8. Each vulnerability includes complete technical documentation, working exploit scripts, and step-by-step reproduction instructions.
The disclosed vulnerabilities are predominantly unauthenticated remote code execution flaws in critical infrastructure and enterprise software. Notable examples include a CVSS 9.8 flaw in InterSystems IRIS involving property injection, multiple critical issues in Brekeke SIP Server (including JavaScript engine exploitation and Zip Slip attacks), and hardcoded credential vulnerabilities in Altus BluePlant SCADA software.
This initiative demonstrates the accelerating capability of large language models to discover complex security flaws at scale, while simultaneously raising significant questions about responsible disclosure practices, vendor coordination, and the potential weaponization of fully documented exploits in production systems.
- Raises urgent questions about responsible AI-powered vulnerability disclosure and the risks of publicizing complete exploits for unpatched systems
Editorial Opinion
The 0day Rubbish project showcases an exciting frontier for AI in security research—using LLM ensembles to systematically discover vulnerabilities that human researchers might miss. However, the full-disclosure model with working exploits published without vendor notification or patch coordination represents a significant escalation in vulnerability disclosure practice that could leave millions of production systems exposed. This tension between transparency and harm mitigation will likely become a defining policy question for how the security community governs AI-powered research.
