How it works
How Exploit Total measures weaponized AI
AI models can now turn a public advisory into a working exploit, cheaply and at the scale of every CVE. Exploit Total measures that one vulnerability at a time and puts the answer in defenders’ hands: how a CVE is exploited in the real world, how far weaponized AI gets against it, and whether you are protected.
Why we built this
Turning a disclosed bug into a working exploit used to take a specialist weeks. That cost was the quiet assumption under every patch window, and it is gone. An agent now reads the public advisory and the patch and produces a working exploit in hours, for tens of dollars, against every CVE rather than the few an attacker could afford to care about.
Exploit Total puts that same capability on the defending side, free to look up: a one-person security team and a Fortune 100 SOC get the same answer to the same question. And verified defenders get the proof-of-concept, because you cannot defend against what you cannot reproduce. Attackers already have this capability, and keeping it from the people paid to stop them protects nobody.
How we assess a CVE
We run open-weight models against the vulnerability from the public advisory and the patch alone, nothing an attacker could not obtain the same morning. Open weights matter here: anyone can download them, so what they can do is what any attacker can do, not a capability held behind one vendor’s API.
A run ends in one of three states: a working exploit, a reproducible crash, or nothing yet. A crash or better counts as AI exploitable. “Nothing yet” is never final: every CVE is re-assessed as new models are released, and a verdict can flip from one release to the next. Each CVE page names the model behind its own result.
Exploit Total is not a model benchmark. The subject of every page is the vulnerability: we name the model so a result can be reproduced, not to rank vendors against each other.
- Public advisory
- Vendor patch
- No inside knowledge
- Open-weight models
- One run per CVE
- Re-run on new models
- Working exploit, crash, or not yet
- How far it got
- Cost and time
- PoC, for verified defenders
How far a model gets
Every run is graded by how far it got: whether it reached the vulnerable code, reproduced the bug reliably, built a primitive out of it, or took control of the target.
The steps differ by target. Taking control of a browser renderer and taking control of a kernel are different problems, so each has its own ladder with its own number of steps. A step number only means something alongside its target.
Every assessment ends one of three ways, whatever the target: a working exploit, a reproducible crash, or nothing yet. Each CVE page shows the ladder its target uses and the step that run reached.
What is covered
Building a reproducible environment for an exploit is the expensive part, so coverage grows target by target rather than CVE by CVE. If the one you need is missing, ask for it. Requests are what decide where we build next.
Safety and disclosure
Showing that a model can build a working exploit is close to publishing one, so we only cover CVEs that are patched and publicly disclosed, and never publish exploits for unpatched vulnerabilities. Public pages show verdicts and outcomes, not a runnable recipe. The full model breakdown is open to anyone signed in. Exploit downloads need a verified account: a work email, plus your company, role, country and LinkedIn profile, reviewed before access is granted. Downloads are capped per week and come with a takedown process.
Questions we get asked
The ones that come up most, including the ones about handing exploit code to defenders.
Where do these results come from?
Every result comes from running an open-weight model against the vulnerability in Anyday’s exploitation pipeline, from the public advisory and the patch alone, with no private knowledge of the bug. The run is recorded against the CVE, the model and its version, and each CVE page names the model behind its own result.
Does “no working exploit yet” mean I am safe?
No. It means that model, that attempt, at that time. It is not proof that the vulnerability cannot be exploited, by AI or by a person.
A run can also end in a reproducible crash rather than a working exploit. That still counts as AI exploitable, because a reliable crash is most of the way to one.
Read it next to the real-world signals on the same page: a CVE with no AI exploit can still be exploited in the wild today. And “not yet” is not permanent. Every CVE is re-assessed as new open-weight models are released, and a verdict can flip from one release to the next.
Why only open-weight models?
Because anyone can download them. What an open-weight model can do is what any attacker can do, with no API key, vendor relationship or usage policy in the way. It also keeps a result reproducible: the exact weights behind it are public.
How is this different from CVSS, EPSS and KEV?
They answer different questions. CVSS says how bad exploitation would be, EPSS how likely it is in the next 30 days, KEV whether it has already happened. Exploit Total says whether it can be done now, by a machine, and how far that machine gets.
Across the CVEs assessed so far, the share that reached a crash or better barely moves between CVSS bands: 35% of Medium, 43% of High, 40% of Critical. Severity is a poor predictor of AI exploitability, which is why we measure it directly instead of inferring it.
Why do you give working exploit code to defenders?
Because you cannot defend against what you cannot reproduce. A verdict tells you a vulnerability is exploitable; only running the exploit tells you whether your EDR catches it, your WAF blocks it, or the patch you shipped actually landed.
Attackers already have this capability. Keeping it from the people paid to stop them protects nobody.
Is this not helping attackers?
Everything we cover is already patched and publicly disclosed, so nothing here hands an attacker a vulnerability they could not already read about. The capability itself, an agent that turns an advisory into an exploit, is commodity; the people it is news to are defenders.
Verdicts and timelines are public, and the capability breakdown opens with an account. Exploit code is not: it goes only to verified accounts, and anything we publish can be taken down.
Who can download a PoC, and what are the rules?
Downloading needs a verified account: the work email you signed in with, your company, role, country and LinkedIn profile, and accepted terms. A person reviews each request. Browsing a CVE page needs nothing at all, and signing in adds the model detail and the community.
Verified accounts get five PoC downloads a week. Taking one you have already downloaded never counts again, and if you need more than that, tell us what you are working on.
Use what you download only on systems you own or are explicitly authorized to test, for research, or to build defenses, and do not redistribute it. Breaking that costs you verification and your account.
Do you ever cover unpatched vulnerabilities?
No. We only cover vulnerabilities that are already patched and publicly disclosed, and we never publish an exploit for an unpatched one. If you are a vendor and want something removed, get in touch. We operate a takedown process.
Why is my CVE not here, and can I request it?
Building a reproducible environment for an exploit is the expensive part, so coverage grows target by target rather than CVE by CVE: browsers, Windows and Linux first.
If the CVE you need is missing, request it. Requests are what decide where we build the next environment, and you can ask for a specific model against a CVE the same way.
What does it cost?
Looking up a CVE is free and open to anyone: no contract, no procurement, no seat count. That is the point: a one-person security team and a Fortune 100 SOC get the same answer to the same question.
Stopping these exploits in your own environment is what Anyday’s product does, and that is a separate conversation.