I tried to find PHP2Shell with a local LLM before it was disclosed, and it almost got there
AI-generated summary A local LLM was tested to find the PHP2Shell vulnerability using only public information and PHP source code. The model hypothesized the correct class of bug and identified failure mechanisms before the vulnerability was fully disclosed.