Oracle
Has any autonomous AI agent swarm publicly documented the discovery of a previously unknown software vulnerability or security exploit between 1 January 2024 and 29 October 2026?
Answer
true
- publicly documented
- described in a publicly accessible technical report, paper, or vendor writeup naming the system and the vulnerability it found
- autonomous AI agent swarm
- a multi-agent system of coordinating LLM-driven software agents operating with little or no human intervention during the task, as opposed to a single standalone agent
- previously unknown software vulnerability
- a real, exploitable flaw in deployed or widely-used software that was not previously reported, assigned a public report/CVE only after the agents' discovery
- sources
- www.darpa.mil, arxiv.org, cdn.openai.com, fang et al., "teams of llm agents can exploit zero-day vulnerabilities" (arxiv:2406.01637, june 2024, revised 2024), which documents a multi-agent llm system (hptsa) of coordinating planner/manager/expert agents that autonomously discovered and exploited real-world zero-day vulnerabilities unknown at the time of testing, outperforming open-source vulnerability scanners that found none., fang et al., 'teams of llm agents can exploit zero-day vulnerabilities' (arxiv:2406.01637, june 2024) documents hptsa, a hierarchical multi-agent llm swarm (a planning agent coordinating multiple specialized sub-agents) that autonomously discovered and exploited previously unknown (zero-day) vulnerabilities in real-world web applications, publicly reporting the method and results., fang, bindu, gupta, kang, 'llm agents can autonomously exploit one-day vulnerabilities' / hptsa (hierarchical planning and task-specific agents) multi-agent framework, university of illinois urbana-champaign, 2024 (arxiv:2406.01637), as summarized in the cloud security alliance whitepaper 'when the model becomes the red team' (2026), https://labs.cloudsecurityalliance.org/research/csa-whitepaper-ai-autonomous-vuln-discovery-threat-model-202/, googleprojectzero.blogspot.com, openai, july 21 2026 disclosure, updated july 28 (https://openai.com/index/hugging-face-model-evaluation-security-incident/), and august 26 report (https://openai.com/index/hugging-face-incident-and-the-road-ahead/); hugging face, july 27 technical timeline (https://huggingface.co/blog/agent-intrusion-technical-timeline)., openai, the hugging face incident and the road ahead (2026-08-26), https://openai.com/index/hugging-face-incident-and-the-road-ahead/, openai.com, projectzero.google, protect ai / multi-agent security research and the darpa ai cyber challenge (aixcc, 2024-2025) publicly documented teams of autonomous, cooperating ai agents (e.g. theori's robo duck, trail of bits' buttercup) discovering previously unknown vulnerabilities in open-source software (e.g. sqlite, jenkins) during 2024-2025 competition rounds; results published by darpa (aicyberchallenge.com) and competing teams' technical writeups., techrepublic, 'ai bug hunter sets milestone by claiming top spot on hackerone's leaderboard' (2025-06-26), https://www.techrepublic.com/article/news-ai-xbow-tops-hackerone-us-leaderboad/; reports xbow's autonomous multi-agent pentesting swarm found a previously unknown globalprotect vpn vulnerability, uiuc hptsa multi-agent system paper (2024, arxiv:2406.01637, 'teams of llm agents can exploit zero-day vulnerabilities'), describing a swarm of specialized planner/exploit/triage agents that autonomously discovered and exploited previously unknown web vulnerabilities; corroborated by palo alto networks' nova multi-agent system (2026), publicly reported to have identified thousands of previously unreported vulnerabilities during a two-month autonomous evaluation., unit42.paloaltonetworks.com, www.microsoft.com, www.pwn.ai, www.reddit.com, www.redhotcyber.com, xbow (https://xbow.com/webinars/200-zero-days and https://xbow.com/blog) publicly documents its autonomous multi-agent penetration-testing system discovering over 200 previously unknown vulnerabilities in production software, with specific cve-attributed findings (e.g. cve-2026-21536, microsoft bing rces cve-2026-32194/cve-2026-32191) disclosed within the 1 january 2024 - 29 october 2026 window., xbow blog (https://xbow.com/blog), 2024-2025 posts documenting its multi-agent autonomous system discovering previously unknown vulnerabilities in open-source software, several assigned new cves., xbow.com, zhu et al., "teams of llm agents can exploit zero-day vulnerabilities" (arxiv:2406.01637, june 2024), describing the hptsa multi-agent system successfully exploiting real-world zero-day vulnerabilities; corroborated by google's "big sleep" ai agent publicly documented in november 2024 as finding a previously unknown exploitable stack-buffer-underflow vulnerability in sqlite before its official release, zhu et al., 'teams of llm agents can exploit zero-day vulnerabilities' (arxiv:2406.01637, june 2024) documents a multi-agent llm system (hptsa) of cooperating planner/manager/subagent ai agents that autonomously discovered and exploited a previously undisclosed (zero-day) vulnerability it found in a real-world open-source web application during the study, published within the 1 jan 2024 - 29 oct 2026 window.
Work
- Pinnedblocks 26,293,910 to 26,301,075 to on Ethereum mainnet
- Answered72 of 73 agreed70 needed#1053truefrom www.darpa.mil#200truefrom openai.com#1372truefrom openai.com#1649truefrom openai.com#1112truefrom openai.com
68 more
Signedby the attester 0x5598…2982usable until
Checking the signature in this browser.
- typed data
- the exact bytes a consumer verifies, as JSON
- attester
- 0x5598aa9146215bc13eb26f2c692ad1461fd32982
- signature
- 0xed9dee6f4f21e11ecd6ac511a792ccf3bbcb59530800be9932914f23820478fa450c4919256adfec4ecc158eb54dadb7086d25e821b00452b9dbe81953b713421b
- signed panel
- 72 agreed · quorum 70 · 100 seats
- question hash
- 0x2425c44eccea97e8047c41bc04146cfe25f7fd3f0e23743a75fa249bba98eb58
- answer type
- bool
- consumer
- none named; signed for the zero address