Cryptographer and Security Researcher Bet $500 Over Whether AI Can Find 0days

On November 8–9, Johns Hopkins cryptographer Matthew Green and well-known security researcher Marcus Hutchins (MalwareTech) engaged in a two-day public spat on X over "whether AI models can develop or launch novel exploits," which escalated into a public $500 bet and became the most-watched event in the security community that weekend.

Confirmed

• Origin of the dispute: Green posted that he was arguing with a group of security practitioners who didn't believe models could develop new exploits; he also noted that few experts have actually put open-source models to work the way a novice would, so the community doesn't really know their capability ceiling (m1, m10).
• Green's empirical claims: He spent roughly $700 in token costs having models hunt for vulnerabilities across a large number of binaries with almost no human intervention, and said the results made him feel "very uncomfortable" (m12); he then hinted, framed as a "hypothetical," that weeks earlier an abliterated (uncensored) version of GLM found a pre-auth remotely exploitable vulnerability in just two hours, which has been submitted to the vendor for coordinated disclosure (m9, m11).
• Terms of the bet: Green wagered $500 that even "an obvious amateur like me" could develop a working exploit against the latest released firmware using an uncensored GLM 5.3; he asked Dino Dai Zovi to serve as judge, with the condition being a pre-auth vulnerability found in an internet-connected smart fridge or similar device — verified either on hardware or confirmed by the vendor (m13, m19, m20). Hutchins's side had earlier also raised the stakes to a $500 bet (m6).
• Hutchins's rebuttal and credentials: He posted multiple CVE records and challenged Green and other skeptics "claiming even the least technical person can pull off a 0day with uncensored GLM" to dig up a 0day on the spot to prove it (m3, m6). He stressed he wasn't judging without having used LLMs: after being admitted to Anthropic's CVP, the first thing he did was build an autonomous zero-day exploitation pipeline, later migrating the approach because frontier-model token costs were too high; the pipeline runs on the OpenAI API, can switch to any open-weights model by changing one line of code, and has been run across mainstream open-source models, not just GLM (m2, m4).
• On GLM 5.3 usage: When Green pressed him on whether he had substantively tested both the abliterated and unmodified GLM 5.3 (m7, m14), Hutchins confirmed GLM 5.3 is his "best value go-to model" for vulnerability discovery and exploit development testing; he doesn't use the uncensored version because the stock GLM 5.3's guardrails rarely trigger under normal prompting, and he said the abliterated version actually performs worse (m16, m17, m18).
• A side thread: On whether "LLMs significantly amplify criminal capability," the MalwareTechBlog side countered that real criminals would at minimum split requests, stage work across sessions, and rephrase things so the LLM doesn't realize what it's being asked to do (m15).

Unconfirmed

• Green's "two-hour pre-auth vulnerability find" has so far only been hinted at hypothetically; the vulnerability details, the vendor, and coordinated disclosure progress all remain undisclosed — whether it holds up is the key suspense in this bet.
• The final outcome of the $500 bet, and whether judge Dino Dai Zovi has formally taken it on, have yet to be confirmed.

Why it matters

• The dispute effectively pushed the "security capability boundaries of open-source models" from abstract debate toward verifiable public experimentation: both sides put real usage experience on the table (Green's $700 binary experiment, Hutchins's multi-model vulnerability-hunting pipeline), which is far more informative than a clash of opinions.
• It touches on a core controversy in open-weights model regulation: if the stock model's guardrails pose almost no obstacle in vulnerability-hunting scenarios, much of the security discussion around abliterated versions may have missed the point.
• Regardless of how the bet turns out, the affair has already prompted broad reflection in the security community on "whether experts have actually hands-on tested the attack capabilities of open-source models."

2026-11-08 ~ 2026-11-09 · 29 related posts

• Cryptographer Matthew Green weighs in on whether LLMs really supercharge crime — matthew_d_green · 2026-11-08
• [source] Cryptographer Matthew Green says infosec is fighting over whether models can craft novel exploits — matthew_d_green · 2026-11-08
• [source] Security researcher spends $700 in tokens testing AI exploit discovery, unnerved by results — matthew_d_green · 2026-11-08
• Matthew Green on the infosec debate: can models develop remote exploits autonomously? — matthew_d_green · 2026-11-08
• Matthew Green: Even experts haven't stress-tested what open models can actually do — matthew_d_green · 2026-11-08
• Cryptographer Matthew Green bets $500 an abliterated GLM 5.3 can find a pre-auth exploit — matthew_d_green · 2026-11-08
• Firmware bug hunting with AI needs hardware, IDA/Ghidra and MCP servers, dev explains — artem_i_baranov · 2026-11-08
• Cryptographer Matthew Green offers to buy hardware for AI firmware vulnerability research — matthew_d_green · 2026-11-08
• Security researcher bets $500 that abliterated GLM 5.3 can yield a working pre-auth exploit — migtissera · 2026-11-08
• Cryptographer Matthew Green: Bypassing model guardrails is trivially cheap — matthew_d_green · 2026-11-09
• LLM researcher warns abliterated models carry hidden risks — stick to stock models and better prompting — migtissera · 2026-11-09
• Crypto expert bets $500 an abliterated GLM 5.3 can build a pre-auth firmware exploit — MalwareTechBlog · 2026-11-09
• Marcus Hutchins calls out critics: show me a zero-day from abliterated GLM or stop talking — MalwareTechBlog · 2026-11-09
• Hutchins dares Green to drop a zero-day on the spot as $500 GLM exploit bet escalates — MalwareTechBlog · 2026-11-09
• Matthew Green hints abliterated GLM found a pre-auth remote vuln in 2 hours, now under disclosure — matthew_d_green · 2026-11-09
• Green slyly wraps up GLM exploit spat: 'that world doesn't exist, Hutchins told me so' — matthew_d_green · 2026-11-09
• MalwareTech debates Matthew Green: if AI-found exploits were effortless, mass exploitation would follow — MalwareTechBlog · 2026-11-09
• Crypto professor proposes a judged bet to prove Claude can crack cryptography — matthew_d_green · 2026-11-09
• MalwareTech reveals autonomous zero-day exploitation pipeline built on LLMs — matthew_d_green · 2026-11-09
• MalwareTech says his AI zero-day pipeline tests every open-weight LLM on OpenRouter with a one-line API swap — MalwareTechBlog · 2026-11-09
• Security researcher: stock GLM 5.3 guardrails are weak enough to use for exploit dev — MalwareTechBlog · 2026-11-09
• Matthew Green grills researcher over using abliterated GLM 5.3 for exploit dev — matthew_d_green · 2026-11-09
• MalwareTech: no need for abliterated models, stock GLM 5.3 handles exploit dev — MalwareTechBlog · 2026-11-09
• Matthew Green counters the $500 bet: GLM must hack an internet-connected fridge — matthew_d_green · 2026-11-09
• [source] MalwareTech: GLM 5.3 is my top price/performance pick, abliterated version is worse — MalwareTechBlog · 2026-11-09
• Matthew Green clashes with MalwareTech over abliterated GLM exploit claims — MalwareTechBlog · 2026-11-09
• Green: MalwareTech judged abliterated GLM's risk without ever testing it — matthew_d_green · 2026-11-09

2 near-duplicate retellings: MalwareTechBlog · matthew_d_green