OpenAI o3

AI Accelerates Vulnerability Discovery and Offensive Research but Falls Short of Replacing Human Expertise, Studies Reveal

Recent research examines how frontier AI models are reshaping cybersecurity practices, particularly in vulnerability discovery and attack execution. The PHP2Shell case involving CVE-2026-109618 and CVE-2026-109619 demonstrates that AI tools helped professional teams confirm remote code execution in the PHP interpreter after initial signs were spotted in 2024. A separate RAND Corporation study with 157 participants tested whether access to models such as OpenAI o3, GPT-5, Claude Opus 4.1, Claude Sonnet 3.7 and Gemini 2.5 Pro enables non-experts to complete full attack chains. Results showed modest gains on early onboarding tasks but no statistically significant improvement in completing complex multi-stage operations. The analysis also highlights increased noise in vulnerability reports submitted to the PHP Foundation, underscoring that AI expands both offensive and defensive capabilities without removing the need for specialized knowledge.