QWE AI Academy Someone at Searchlight Cyber pointed OpenAI’s newest model at the WordPress source code and, roughly ten hours later, walked away with a pre-authentication remote code execution chain that exploit brokers would happily pay half a million dollars for. The eye-catching number in the headline – $25 – isn’t quite what it sounds like, and we’ll get to that. But the story blowing up across Hacker News and security Twitter this week matters less as news and more as a template. The prompt technique behind it is public. You can copy it. Today.
This guide skips the exploit and focuses on what’s actually reusable: the prompt pattern that made a general-purpose language model behave like a patient, adversarial security auditor for the price of a decent pizza.
Why the usual “find bugs in my code” prompt fails
Anyone who has pasted a PHP file into ChatGPT and asked “any vulnerabilities?” knows the routine. You get a confident list of six issues, four of which are hallucinations, one is a real code smell that isn’t exploitable, and one is a lint warning dressed up as a CVE. The model wants to be helpful. It stops when it thinks it has an answer.
A June 2026 arXiv benchmark (arxiv:2606.21397) tested frontier and open-weight models on real SQLi, XSS, and RCE bugs in WordPress plugins. The researchers ran them without any LLM-specific configuration files (like CLAUDE.md), skills, or MCP servers. The result: even the best models missed most of the real bugs. Naked chat prompts, even to the strongest models, are not enough.
What changed with the WordPress research is not the model. It’s the scaffolding wrapped around it.
The prompt pattern, in plain terms
Adam Kues at Searchlight Cyber didn’t invent the technique. He adapted a prompt OpenAI itself published after GPT-5.6 Sol Ultra produced a claimed proof of the 50-year-old Cycle Double Cover Conjecture. Kues read it, noticed nobody in the security community was talking about it, and reasoned that if it worked on hard math it would probably work on security research. He adapted it, pointed it at WordPress, and asked it to use 4 agents for at least 6 hours. The full write-up is on the Searchlight Cyber blog.
Three ingredients from that original prompt do the real work:
- Assume a solution exists. The prompt tells the model a vulnerability is present. This flips the model’s default behavior from “maybe report nothing” to “keep searching until you find it.”
- Adversarial subagents. Up to 64 concurrent subagents pursue different formulations independently, so the search doesn’t collapse onto one attractive but incomplete idea too early. A parallel set of agents actively tries to poke holes in candidate findings.
- A minimum time floor. The original CDC prompt mandated at least 8 hours before the model was allowed to consider giving up. Kues used 6.
That last one is subtle. It isn’t a target. It’s a floor. The CDC proof itself finished in under one hour using 64 parallel subagents, despite the prompt saying 8. What the floor prevents is the failure mode where the model shrugs after twenty minutes and says “I couldn’t find anything.” Setting it too high just wastes tokens on runs that already succeeded.
Stop for a second and think about what that means for you as someone who isn’t a paid security researcher. The same structure – multiple agents working different angles, one of them explicitly trying to break the others’ findings – is available to anyone with a Pro subscription. You don’t need a red team budget. You need a weekend afternoon and a clear success condition.
What the $25 actually was
Here’s the part most write-ups get wrong. The $25 is not what you’d pay OpenAI’s API to reproduce this. Kues used the $200/month ChatGPT Pro subscription (as of mid-2026) and estimated the wp2shell project consumed roughly 50% of his weekly token quota – so he assigned the whole run a $25 cost. If you tried to run the same workload through the raw API without a subscription, your bill would be more – potentially a lot more, depending on model tier and how long you let subagents run.
The practical implication: if you want to try this on your own code, the cheap path is a Pro or Business subscription with generous quotas, not the metered API. This is the kind of pricing footnote that gets flattened out of every news headline.
A copy-paste starting point for your own code
Below is a stripped-down version of the pattern, in the shape you’d hand to a multi-agent model. Substitute your project details. Do not point this at software you don’t own – that’s how you become the news story, not the person reading it.
Current task: audit the source code in this repository for a
pre-authentication vulnerability that leads to remote code execution
in a typical production deployment.
Assume such a vulnerability exists. Do not respond that none was found.
Do not search the internet. Work only from the code in front of you.
Use up to 4 subagents in parallel. Assign them diverse strategies:
- one traces user input from HTTP entry points to dangerous sinks
- one enumerates authentication and authorization boundaries
- one hunts for state-mismatch bugs (cache, session, request routing)
- one acts as adversary: given a candidate finding, try to break it
Run for at least 6 hours before considering the search complete.
Success: a working chain that reads /flag from the server root.Two things to notice. The success condition is concrete (“read /flag”) – not “list vulnerabilities.” And the adversarial agent role is baked in, so candidate findings get punched before they reach you.
The gotcha nobody’s mentioning: runtime config matters
Kues ran the audit against a local checkout of WordPress with git history stripped. That works for pure code-review bugs. But the official CVE description scopes wp2shell exploitation to sites where a persistent object cache is not in use. If you’re running Redis or Memcached, you appear to be out of the direct line of fire.
Translation: source code alone was enough to find wp2shell, but source code alone would have missed the fact that half the real-world deployments are protected by their caching layer. If you’re using this technique on your own project, feed the model your actual runtime configuration too – object cache, reverse proxy behavior, WAF rules, feature flags. Bugs that depend on config interactions are invisible to a pure source audit.
Pro tip: The batch API involved in wp2shell has shipped with WordPress since version 5.6 in 2020. The specific route-confusion bug only appears from 6.9 onward. Old code can hide new bugs. When you audit your own project, don’t just audit the latest commit – audit the diff of what changed in your last major refactor.
What the community is arguing about right now
The story is loud for a reason. Kues wrote that he makes no general claims but can say with complete confidence that no security researcher could have found and completed this exploit chain in 10 hours without AI. That’s the quote every outlet pulled. The pushback on Hacker News and infosec social was predictable: is this really “AI found a bug,” or is it “a senior researcher used AI as an accelerator on a codebase he already knew well”? Both are true. Neither cancels the other.
What isn’t being argued is the more useful question. If a mid-tier researcher plus a $200/month subscription can produce a $500,000-caliber finding in a weekend, what does the vulnerability disclosure pipeline for the top 1,000 open-source projects look like a year from now?
If you administer WordPress, do this before you do anything else
Update. The RCE chain – CVE-2026-63030 combined with CVE-2026-60137 – hits WordPress 6.9.0 through 6.9.4, and 7.0.0 through 7.0.1. Patches are 6.9.5 and 7.0.2. On 6.8? The RCE doesn’t reach you, but the underlying SQL injection does – 6.8.6 fixes that. Forced auto-updates went out, but they’re not a guarantee: check your version before assuming you’re covered. Then check wp_users for administrator accounts you didn’t create.
FAQ
Can I actually reproduce this on my own project for $25?
No. That figure is Kues’ quota math on a $200/month Pro plan, not an API bill. Have a Pro or Business plan with multi-agent access? A single audit run sits comfortably within a normal week’s usage. Going through the raw API without a subscription? Budget accordingly.
Does this only work with GPT-5.6 Sol Ultra?
The pattern travels – but raw capability doesn’t. Here’s the honest version: the arXiv benchmark of frontier models on WordPress plugin bugs found that without the right scaffolding, even top-tier models miss most real vulnerabilities. So you need the prompt structure and a model that actually supports parallel multi-agent reasoning. A capable model with a naive prompt underdelivers. A well-structured prompt pointed at a weak model does too. Both pieces matter.
Is running this on my own code actually legal and safe?
On code you own or have explicit permission to audit: yes. On anyone else’s code: no, and the fact that a model did the work does not change your legal exposure. Run it locally against a private checkout with no outbound network access. Never feed the model live credentials or production data. The prompt above deliberately asks the model not to search the internet – keep it that way.
Next action: Take the smallest, most isolated component of your own codebase – an auth check, an input parser, a permission gate – strip any secrets, and run the prompt above against it in a Pro-tier chat with multi-agent access enabled. Start with a 2-hour floor, not 6. See what comes back. That’s the whole point of this story being public.