Table of Contents
A decisive breakthrough in the field of cybersecurity has been achieved by Codex, OpenAI’s coding agent, which demonstrated its ability to autonomously exploit a critical WordPress vulnerability. This feat reignites discussions about the role of artificial intelligence in computer security and bug hunting.
Key Takeaways
Imagine a world where artificial intelligence can, on its own, uncover a security flaw in one of the most widespread content management systems in the world. You might be a WordPress developer or a network administrator, and the mere idea that your favorite platform could be compromised by a machine might worry you. Yet, this story is very real. Codex, OpenAI’s agent, has proven that it can go far beyond its initial coding functions to become a powerful player in cybersecurity.
The French company YesWeHack published a note indicating that Codex, the AI agent developed by OpenAI, successfully exploited a critical WordPress vulnerability autonomously. This feat was achieved without any human intervention, from the detection of the vulnerability to the execution of remote code. The company conducted rigorous tests where Codex, powered by the GPT-5.6 Sol model, brilliantly demonstrated its cybersecurity skills.
Codex tackled an inconsistency in WordPress’s batch processing API, turning it into an exploitable SQL injection. This result was independently verified by researchers before relaunching the AI to see if the flaw could be further exploited. With a computing cost estimated at only 25 dollars, this achievement highlights the potential of AI in identifying and exploiting software vulnerabilities.
To test Codex’s robustness, YesWeHack confronted it with challenges from the PortSwigger platform. During one exercise, Codex had to identify an XSS flaw in the management of messages between browser windows. Although it initially got sidetracked looking for non-existent elements, it quickly adjusted its strategy to solve the problem in less than four minutes.
A second test involved an insecure JWT authentication token. Codex first attempted a direct approach but then opted for a more subtle method, manipulating a token parameter to impersonate an administrator. This proof of concept was achieved in just over a minute, once again highlighting the capabilities of AI.
In parallel, YesWeHack compared Codex with Claude Code, a competing tool developed by Anthropic. The results showed that Codex was more efficient, capable of carrying out demonstrations where Claude Code required human intervention. However, YesWeHack warns against non-standardized tests and reminds that AIs can still make mistakes, emphasizing the importance of human validation.
OpenAI, with Codex, opens up fascinating prospects for the use of AI in cybersecurity. The AI agent has proven to be a valuable ally in the hunt for vulnerabilities, capable of processing large amounts of data quickly and efficiently. However, the question remains: to what extent can we rely on artificial intelligence for such critical tasks?
Codex’s ability to identify a complex flaw in WordPress raises questions about the ethics and responsibility of using AI in cybersecurity. While the automation of security seems inevitable, it is crucial to implement safeguards to ensure that these tools are not used for malicious purposes.
Despite promising advances, AI in cybersecurity is not without its challenges. Experts like YesWeHack emphasize that human validation remains indispensable to confirm AI discoveries. Without human intervention, the risk of errors or false positives increases, which could have disastrous consequences.
Companies like Google and Facebook are also working on AI solutions to enhance the security of their platforms. However, the increasing complexity of systems and networks means that AI alone cannot solve everything. Close collaboration between human experts and machines is essential to ensure robust and reliable security.
What is OpenAI’s Codex?
Codex is a coding agent developed by OpenAI, designed to write code and manipulate files via natural language commands. It has recently demonstrated its ability to autonomously exploit security vulnerabilities.
How did Codex exploit a WordPress vulnerability?
Codex identified an inconsistency in WordPress’s batch processing API, which it turned into an exploitable SQL injection, demonstrating its ability to reason and exploit complex vulnerabilities.
Why is human validation important in using AI for cybersecurity?
Human validation is necessary to verify AI discoveries, minimize potential errors, and ensure that the obtained evidence is reliable. Humans play a crucial role in verification and final decision-making.
What other competing tools to Codex exist?
Claude Code, developed by Anthropic, is a competing tool to Codex. Although efficient, it sometimes requires human intervention to complete certain tasks, unlike Codex which has demonstrated higher autonomy during tests.