Security teams have a new option for assessing vulnerabilities: AI-generated exploits designed to help test their defenses.
Anyday Security launched ExploitTotal on November 11, 2026, a free AI-powered platform offering vulnerability assessments and proof-of-concept (PoC) exploits for defensive testing. The company says it has generated more than 200 working exploits, potentially helping organizations prioritize remediation and validate security controls.
“AI has collapsed the distance between a vulnerability and an exploit,” said Yonatan Gorfung, Anyday Security's CEO and co-founder. Gorfung argues that the absence of publicly available exploit code no longer reliably indicates how difficult a vulnerability may be to exploit.
How ExploitTotal works
In its launch announcement, Anyday said it tested the open-weight GLM-5.3 model against more than 200 vulnerabilities using public advisories and vendor patches. It reported that 72% of successful exploits had no previously public exploit.
ExploitTotal's published methodology classifies results into three outcomes:
- Working exploit: The model gains control of the target.
- Reproducible crash: The vulnerability is triggered without demonstrated control.
- Unsuccessful attempt: Exploitability is not demonstrated during testing.
The platform covers selected Chromium, Firefox, Windows, and Linux vulnerabilities. Google's recent Chrome zero-day security update illustrates the need to address browser flaws exploited in the wild.
Public searches are free, while PoC downloads require professional verification and are limited to five weekly.
How defenders could use generated exploits
ExploitTotal aims to help security teams move beyond severity scores by testing whether vulnerabilities can be exploited in their environments.
“A security team knows of thousands of vulnerabilities in its environment but has a working exploit for almost none of them,” said Omri Sibony, Anyday Security's co-founder and chief technology officer.
“Our system produces exploits the same day a vendor releases its fix, so a team can look up its own vulnerabilities, run the exploit against its systems and see whether its tools stop the attack. If not, it can write a detection rule or virtual patch against the real attack instead of finding out during a breach.”
Independent research supports the broader feasibility of AI-assisted exploitation. Epoch AI demonstrated that GLM-5.3 could develop working Firefox exploit chains under controlled conditions. However, those findings do not independently validate ExploitTotal's reported performance.
Recent CrowdStrike findings on exploit timelines also documented exploitation within 35 minutes of public PoC release in one observed case.
How organizations can mitigate risk
Organizations can strengthen their defenses against rapidly exploited vulnerabilities through these measures:
- Prioritize and patch exposed systems: Use asset inventories, CVSS, EPSS, and CISA KEV updates to guide remediation.
- Apply compensating controls: Deploy virtual patches, WAF rules, IPS protections, or access restrictions when immediate patching is impractical.
- Reduce attack surfaces: Disable unnecessary services, restrict administrative access, and segment critical systems.
- Validate detection capabilities: Test authorized PoCs in isolated environments and verify that security tools detect exploitation attempts.
- Test incident response plans: Exercise escalation, containment, and recovery procedures for rapidly exploited vulnerabilities.
Anyday's terms of use warn that PoC execution may not be safe or non-destructive.
ExploitTotal could help defenders validate exposures and improve detections, although its reported results still require independent reproduction across different environments.
Read more: A reported AI-assisted intrusion against a European telecom provider highlights another application of AI agents in offensive operations.