Free site gives AI-made exploits for 200 vulnerabilities on patch day
Anyday Security says 72% of the exploits that its AI made had no public version before.
On 11 November 2026, the US start-up Anyday Security started ExploitTotal.ai, a free catalog of working attack code that an open-weight AI model made. Open-weight means that anyone can download the model and use it. The catalog has more than 200 exploits. Anyday says it compared them with public lists, and 72% had no public exploit before.
How it works
The team gave the model only the notice of the vendor and the patch for each vulnerability. Each page gives a verdict, the cost, the time and a grade from a crash of the target to full control. Verified users can download test code that has no dangerous payload.
The numbers
In one test, the model made a full browser exploit in minutes for less than one dollar. Anyday cites Verizon: firms took a median of 43 days to repair vulnerabilities that attackers used. They fully repaired only 26% of them. Anyday did these tests.
What is not known
No external party did a test. The source does not say how well the exploits work on company systems. It does not say who can get verified access.
Insight: Defenders now use the method of the attacker
Anyday says an attacker needs minutes to make an exploit, while firms take a median of 43 days to repair. An earlier test showed AI agents in code pipelines open to attack. This reads as a race to publish first. Anyday gives defenders the exploit before an attacker can use the time gap. Maybe the catalog also becomes a public score of how fast AI attack skill grows.
Sources
Posted
