OpenAI's GPT-5.6 Sol and Google's Gemini 4 Argon have discovered a critical PHP vulnerability that impacts millions of websites worldwide. GPT-5.6 Sol tracked down the flaw through the Patch-the-Planet initiative, successfully identifying the issue before malicious actors could exploit it. Security firm Wiz independently confirmed the same vulnerabilities using its Wiz Atlas platform alongside Gemini 4 Argon and GPT-5.6 Sol, noting that Gemini 4 Argon proved especially effective for finding the vulnerability, writing exploits, building detection systems, and validating patches.
According to Wiz, large language models remove traditional barriers for cyber attackers by automatically adapting exploits across different PHP versions, configurations, and memory layouts, which significantly lowers the barrier to scaling attacks. The vulnerability fix required a coordinated two-month effort across five phases involving PHP developers, Wiz, Cloudflare, and US agencies including CISA and the White House. OpenAI is now proposing this collaborative process as a repeatable framework for managing future AI-driven security discoveries.
OpenAI expects large-scale security findings to increase sharply in the coming months while warning that the same artificial intelligence capabilities used for defense can also assist attackers. This major discovery highlights the ongoing debate surrounding the dual-use nature of advanced AI models in offensive and defensive cybersecurity.