GLM matches Opus at mass-converting Windows drivers into LPE 0days, says security researcher
MalwareTechBlog · x · 2026-11-09
Security researcher MalwareTech reports using LLMs to mass-convert Windows driver files into usable user-to-kernel privilege escalation 0days, with benchmark numbers:
- Metric: working exploit payloads per driver input. First run: GLM scored 2/100 vs Opus 18/100 with his harness — a big gap.
- He closed the gap by exploiting GLM's lower cost: multiple low-temperature iterations per driver, plus a skeptic agent to review findings and pass only high-plausibility bugs downstream — matching Opus, though that harness improvement also helped Opus.
- The LPE harness inadvertently surfaced a remotely exploitable IPv4 memory corruption in one driver; kernel RCE re-testing is underway.
A rare quantified look at automated LLM-driven vulnerability discovery, and a case study in cheap-model-plus-harness engineering.
More from coding & agent
- Could coding agents make the FDE deployment motion viable below enterprise tier? — curious_vii · 2026-11-09
- Agent-native 3D engine Vork: 2,500-token API, up to 24x faster rendering than Blender — ravisparikh · 2026-11-09
- dsh-legion-plugins adds multi-agent rooms, device control and MCP management to DeepSeek harness — jasonkneen · 2026-11-09
- Exody: a macOS coding workbench with a 5-stage agent loop and per-step multi-model router — Smokiezzz · 2026-11-09
- tldraw and Every converge on a product thesis: build agents for high-trust networks and get security for free — danshipper · 2026-11-09
- Agent edits Qwen 0.8B weights to inject personal facts—no training, no gradients — burny_tech · 2026-11-09