AI discovered 300 WordPress plugin zero-days in 72 hours

A developer launched his AI chatbot plugin and, before pushing it live, ran a security review. The result? 35 vulnerabilities in his own code. Then things got weird: the same AI model, let loose to scan the broader WordPress plugin ecosystem over 72 hours, found roughly 300 zero-days—unknown security flaws nobody had spotted before. This isn't hyperbole.

For plugin developers, this is cold water in the middle of summer. If an AI can find hundreds of critical vulnerabilities in a matter of days just scanning publicly available code, anyone with malicious intent could do the same thing. The era of security holes hiding for months or years? Over. The developer admitted his entire mindset about security shifted overnight: running your code past human reviewers isn't enough anymore. You have to assume a smart machine will find problems anyway, and it'll be thorough.

He started looking at his own code through an AI's eyes: what would it see? Which shortcuts would it exploit? What wrong assumptions would it find? The answer was eye-opening—and sobering. Many vulnerabilities the AI uncovered weren't silly mistakes, but subtle logic flaws, unhandled edge cases, or dangerous configurations that looked harmless at a glance. This completely reshapes how plugin developers think. You can't afford to "hope" nobody finds a hole anymore. An AI will find it.

This discovery kicks open a debate with no easy answers: AI security scanners are becoming tools for responsible developers, but also weapons in the hands of people with bad intentions. The WordPress community needs to move fast. Either developers adopt these tools to find holes before the bad actors do (and the automated bots that are already out there), or they get hit by attackers who already are. There's no comfortable gray zone left to hang out in.