Exploit brokers pay $500k for WordPress RCEs. I found one with GPT5.6 and $25

Security research featured on the **Hacker News Front Page** detailed the discovery of a **Pre Authentication RCE** vulnerability using **GPT5.6** at a total cost of **$25**. The report highlights a stark contrast in vulnerability research economics, comparing the minimal tooling cost against the **$500k** that **exploit brokers** pay for **WordPress RCEs**.

The investigation centered on **Smashing the ServiceNow Sandbox** to achieve remote code execution without requiring prior authentication. Utilizing **GPT5.6**, the methodology analyzed sandbox mechanics to identify structural flaws in the **ServiceNow Sandbox**, enabling a successful **Pre Authentication RCE** exploit path.

For software engineers and security teams, finding a **Pre Authentication RCE** for **$25** demonstrates that AI-assisted vulnerability discovery is accessible and inexpensive. Security teams defending environments like the **ServiceNow Sandbox** must assume that adversaries can run automated analysis using **GPT5.6** at scale, bypassing traditional manual audit delays.

The market context is defined by **exploit brokers** offering **$500k** for high-impact flaws such as **WordPress RCEs**. Demonstrating that **GPT5.6** can discover a **Pre Authentication RCE** for **$25** shifts market dynamics, significantly lowering the resource barrier for security research relative to broker payouts.

Organizations must deploy models such as **GPT5.6** to audit application sandboxes and pre-authentication surfaces proactively. Monitoring how sandbox protections, including the **ServiceNow Sandbox**, withstand low-cost automated testing will determine how fast defensive engineering must adapt.