Will an AI-powered zero-day discovery system be publicly documented as operationally used by threat actors by end of 2026?

Intruder announced an AI-powered 'vulnerability vending machine' that combines LLM code analysis with automated discovery to find complex zero-days. The system successfully identified a previously unknown WordPress plugin RCE and reportedly has additional discoveries in the pipeline (Bleeping Computer). This marks a significant escalation in AI-assisted offensive tooling.

Resolution Criteria

Public disclosure (vendor advisory, CISA alert, security researcher blog, or reputable press) confirming use of an AI-powered system (LLM-based, automated, or hybrid) by a threat actor or security firm to discover or exploit a zero-day vulnerability before the vendor patches it.