NO, LLM AGENTS CAN NOT AUTONOMOUSLY EXPLOIT ONE-DAY VULNERABILITIES

Summary from the TLDR InfoSec newsletter

This blog post takes a critical look at an academic paper that received widespread media attention which claimed to have built an LLM Agent that can exploit one-day vulnerabilities. The author points out that the paper included an agent that had Internet access and that the authors of the paper chose CVEs that had very detailed exploits and PoCs available. The post concludes that the paper demonstrated the capabilities of GPT-4 as an intelligent scanner and crawler but based on the data provided didn't demonstrate its ability to rediscover these vulnerabilities or generate novel exploit code.