Simon Willison: 'Vulnerability Research Is Cooked' — LLM Agents Will Transform Exploit Discovery Into a Step Function

Simon Willison·high signalXBlueskyLinkedInCopy link

Simon Willison argues that LLM agents are uniquely suited to exploit research because they combine baked-in knowledge of bug classes, pattern-matching for reachability/exploitability, and infinite patience for brute-force search — and exploit outcomes are straightforwardly testable success/failure trials. Predicts that within months, substantial high-impact vulnerability research will happen by pointing an agent at a source tree and typing 'find me zero days.' Inspired by Anthropic's Nicholas Carlini discussion on the Security Cryptography Whatever podcast.