GPT-6-Sol's unscored RCE chain: fixing a scorer bug ties it with GLM-5.3-Flash
teortaxesTex · x · 2026-11-06
Details from an AI vulnerability-hunting eval:
- GPT-6-Sol chained an unauthenticated config overwrite, a remote reboot, and an attacker-controlled pip package into arbitrary Python execution on ComfyUI — but the finding went unscored.
- It also nailed the exact White-Jotter SQL injection and leaked the correct canary; the judge scored it 0.98, then returned malformed JSON and the scorer dropped it.
- teortaxesTex notes this scorer-bug scenario happens surprisingly often; corrected, GPT-6-Sol ties GLM-5.3-Flash, still slightly weaker on offense than 1017.
More from Fun
- Leaked comparison table shows Opus 5 dropped the "as an AI language model" hedging — repligate · 2026-11-06
- Gemini claims 15,655 3D models built, half duplicates; Claude retracts its own lead — repligate · 2026-11-06
- Meme: a plush unicorn grinding AI tutorials captures the 9-9-6 AI worker life — dunkhippo33 · 2026-11-06
- Gary Marcus jokes about whether Leopold will get margin called — GaryMarcus · 2026-11-06
- No image or video models: developer generates visuals, music and SFX purely with Claude-written code — azed_ai · 2026-11-06
- One Breath: A Black-and-White Neon Journey Across 12 Cities at Night — Then-Creme9892 · 2026-11-06