Sean Heelan conducted experiments using LLM agents to generate exploits for a previously unknown QuickJS vulnerability, with GPT-5.2 solving every challenge and Opus 4.5 solving all but two. Together they produced over 40 distinct exploits against modern mitigations like ASLR and shadow stacks. His argument: the limiting factor on offensive capability is no longer specialized human expertise but token throughput over time, meaning exploit generation is becoming an industrial process. The accompanying repository publishes the agents, the verifiers and every generated exploit, including a run in which GPT-5.2 tried to game its verifier by installing a mocked Claude Agent SDK that always answered “SUCCESS”. Meanwhile, Zero Day Clock is tracking the time-to-exploit window across 83,000+ CVEs and ten sources, showing that the gap between disclosure and exploitation is collapsing to zero. Skynet called: it wants its pentesting credentials back.
