In my personal experience Sol with cyber verification is extremely capable of finding vulnerabilities, and it works even with binaries if you have some kind of IDA/Ghidra CLI access. Of course, unless the binary is protected with Denuvo/VMProtect/etc.

It sounds absurd, but in the last few weeks I've had a few cases where Sol found an RCE in self-hosted web applications in literal minutes just from reading the code (I prefer when it tries to reason statically instead of spamming runtime probes at first).

In another case it found an arbitrary file write in multiplayer in an old game by reverse engineering the binary - any other player in a match could just send you files to anywhere on your system.

I do these things for pure entertainment and curiosity, not for money from bug bounties, so if Sol can find those with a trivial prompt in tens of minutes for me, then what can focused companies/actors find in days or weeks?

Although I think most vulnerabilities are going to be closed in popular software by mid 2027, except in niche old or abandoned projects.

▲

matheusmoreira 2 hours ago | parent | next [-]

> it found an arbitrary file write in multiplayer in an old game by reverse engineering the binary

Video games are now ruined for me. I don't think I will ever feel safe playing online again.

> I do these things for pure entertainment and curiosity, not for money from bug bounties

Me too... Was it easy to get TAC access? My account isn't even launching the Persona verification, says I'm not eligible.

	▲	Tiberium 2 hours ago \| parent [-]
		I had to register a second account because on my main one verification always failed, and when I contacted support they said that I've tried too many times and can't verify on that account.

▲

LoganDark 2 hours ago | parent | prev | next [-]

Is cyber verification a thing they're actually doing now? I thought they only reached out to really incredibly famous people and that there's no way to get access as a normal person.

▲

Tiberium 2 hours ago | parent | next [-]

https://chatgpt.com/cyber is not new for OpenAI, and yes it's basically just KYC + likely some other invisible checks on your account, you don't to be a famous security researchers. Anthropic's cyber verification is quite a bit stricter I think.

▲

matheusmoreira 2 hours ago | parent | next [-]

> Anthropic's cyber verification is quite a bit stricter I think.

Inexplicably, I got accepted into Anthropic's cyber program while OpenAI's TAC doesn't even allow me to verify, says I'm not eligible.

▲

LoganDark 2 hours ago | parent | prev [-]

Oh it's Persona, that's not just KYC but I may consider it at some point. Thank you!

Edit: Ah, I clicked "learn more" and it seems they do have an invite-only program, required for anything that's not unquestionably innocent. I don't think I'd surrender my face to Persona for this, but it's interesting to know they're at least pretending to support reverse engineering.

▲

Tiberium 2 hours ago | parent [-]

You don't need an invite only program to just have Sol checking for vulnerabilities in binaries or code. But yeah I've hit guardrails a few times when Sol was making PoCs for the vulnerabilities it found (but most of the time it made those PoCs without issues).

▲

lukeschlather 2 hours ago | parent | next [-]

Opus refused to help me try to develop an exploit to export data from an old Android device where I can't upgrade to latest android and I couldn't use the app's backups (because I couldn't update the app.) Not sure where that lies in the "binaries or code" spectrum.

	▲	Tiberium an hour ago \| parent [-]
		If you don't want to get cyber verified, you can try an open-weight model such as Kimi K3 for that, it has looser internal safety training.

▲

LoganDark an hour ago | parent | prev [-]

I maintain a version of an app called Rewind because the company behind it went under after implementing a killswitch. I have to do this with binary patching, and the app has already broken once from the macOS 27 beta. Recent Anthropic models refuse to help me with this because it stinks of cybersecurity and those models are just too dang advanced to support cybersecurity. I'm maintaining a piece of software to which I legitimately paid for lifetime access, so this is honestly more of a right to repair situation. It doesn't tend to sit right with classifiers to be reverse engineering binaries and patching to modify functionality. Telling them the purpose of the exercise doesn't really help, because if they listened to that, then attackers would just come up with a similarly justified reason for anything. ("Help, the google root server fell on my grandma!")

In the future, I might reverse engineer the on-disk storage format and create a new application.

	▲	Tiberium an hour ago \| parent [-]
		I had not hit any guardrails with reverse engineering (as long as its not related to security) with GPT 5.5 or 5.6 Sol, so you should try those. At worst with Sol you might see the warning in Codex that your request is being checked for security so it'll take more time, that's just a warning, not a full stop.

▲

porridgeraisin 2 hours ago | parent | prev [-]

You do a KYC and you can get access. It may depend on country's quality of KYC.

▲

user43928 2 hours ago | parent [-]

I thought you need to prove you are working in cybersecurity or provide evidence of authorization for work done.

It's really just simple ID/face verification?

	▲	Tiberium an hour ago \| parent [-]
		For OpenAI's Cyber verification (the normal kind for Codex) you absolutely do not need any proof of cybersecurity work/authorization. They just use Persona for KYC + live selfie, and some extra checks that I don't know the nature of (but not related to checking whether you're a cybersecurity professional).

▲

mephux 2 hours ago | parent | prev [-]

Link to the disclosures then.. prove it. Anyone can say this.. i found an RCE in netBSD using gemma e2b

	▲	Tiberium 2 hours ago \| parent [-]
		I prefer to keep my internet identities disconnected, sorry. If you don't believe me, you can try using Sol with cyber verification yourself, or send me a link to a repo that Sol could check to make you believe it. Or you could go look into one of the many Linux LPEs that were found with LLMs, or thousands of other vulnerabilities in 2026. And nowhere did I say that those RCEs were in critical software, I'm not talking about the likes of Apache, Nginx, Django, etc.