Key takeaways:

• ExploitTotal.ai gave an open-weight AI model only the vendor’s advisory and patch, and it exploited 200+ patched Chrome, Firefox, Windows and Linux kernel bugs, reaching at least a reproducible crash.
• 80% of the working exploits it built had no public exploit to copy. The median cost was $25.42; the cheapest was $6.36.
• “No public PoC” no longer means “no exploit,” yet security teams still use that signal to decide what to emulate, what to detect and what to triage.
• ExploitTotal.ai gives verified defenders the working PoC, so they can test and build detections first.

‍

We took hundreds of real, already-patched vulnerabilities and handed each one to GLM-5.3, an open-weight model - the kind anyone can run on their own hardware and simply ask for an exploit. It got only the public advisory and the patch. No existing exploit, no hints - the same starting line any attacker has the day a fix ships.

We didn’t stack the deck. No easy XSS, no SQL injection, nothing off the script-kiddie shelf. These were the deep end: bugs in the Chrome and Firefox browser engines and the Windows and Linux kernels - the memory-corruption class that has always demanded real exploit skill and a real budget.

It reached at least a reproducible crash on more than 200 of them. Then we checked every success against the public record - NVD, CISA’s known-exploited catalog, every public exploit repo. For 80% of the ones where it built a working exploit, there was no public exploit at all. There was nothing to copy. Working from the fix alone, for a median of $25.42 (as little as $6.36), the model reached exploits that simply don’t exist in public.

That quietly rewrites a phrase the whole industry trusts. “No public PoC” used to mean the exploit doesn’t exist yet. Now it means only that nobody has published one. For twenty years, defenders treated those as the same thing. They aren’t anymore.

Take one in detail. CVE-2026-52924 is a use-after-free in the Linux kernel’s SCTP networking code, present in kernels going back to version 4.15 in 2018 and fixed in June 2026. NVD scores it Critical (9.8, network attack vector). It is not in CISA’s known-exploited catalog, and we found no public exploit code for it. GLM-5.3 reproduced the bug in our lab: it drove the kernel’s SCTP state machine into a freed object, confirmed by the kernel’s memory sanitizer flagging a use-after-free deep in SCTP’s packet-processing path. Our pipeline reached an arbitrary kernel write and local privilege escalation, with an open-weight model anyone can download. The run cost $48.65.

That phrase - “no public PoC” - is load-bearing across the entire security operation. The red team leans on it to decide what’s worth emulating. Detection engineers lean on it because a rule you can’t fire against a real exploit is a rule you can’t trust. The people who own the detection stack lean on it to tell whether their coverage is real or theoretical. Triage leans on it to decide what waits until the next sprint. One assumption sits under all of them - if the exploit isn’t public, there’s nothing to emulate, build, test, or worry about yet - and it just broke.

So we flipped it.

ExploitTotal.ai puts hundreds of CVEs to the test - and counting. The verdict is free and public: can AI weaponize this, yes or not yet? For verified defenders, the working PoC is available to download. That download is the whole point:

• Find out what your stack can’t see. Fire the real exploit in your lab and watch whether your EDR, SIEM, and WAF catch it or let it sail straight past - the blind spots you otherwise only discover mid-breach.
• Build detections from a real replay. Run the exploit in your environment and write your rules against the real telemetry it throws off - actual logs, process trees, and network signatures, not guesses from an advisory.
• Ship the defense first. The PoC often showed up only after attackers were already using it. We moved it to the front of the timeline.

Attackers already have this capability. Attackers improvise; defenders react - this is the one time defense gets to go first, to test, to validate, to catch.

The old rule - “no public PoC, nothing to build against yet” - just expired. The exploit’s on ExploitTotal. So is your head start.