VulnCheck’s Spencer McIntyre says AI is accelerating vulnerability discovery while leaving a harder question for researchers: what can an attacker actually do? On Practical AI, he separates finding a flaw, reproducing a crash, and producing a reliable exploit. His team uses its Go Exploit framework and existing examples to keep model-generated work inside a consistent structure. Open-source web applications have been productive territory; firmware and closed-source reverse engineering remain harder. More output also means more validation work. McIntyre says over half of the public proofs of concept his team assessed in 2026 looked illegitimate or failed its usefulness standards. That figure covers several failure categories and explicitly excludes whether the code was classified as AI-generated. He also describes researchers moving toward local models because hosted restrictions impede legitimate work and unpublished vulnerability data needs protection. Familiar access-control and unsafe-parsing flaws still recur in AI products. His preferred division of labor is broad automated discovery followed by expert validation and assessment of real-world consequences. These are practitioner observations, not a controlled comparison of models or a measurement of every public exploit.
“Having a structured framework like Go Exploit is very helpful because when we’re working with the LLM, it’s not starting from scratch.” — Spencer McIntyre, 18:07, publisher transcript
“I haven’t seen evidence that full on wide scale exploitation is where we’re currently at.” — Spencer McIntyre, 36:23, publisher transcript