AI model Cyberkimi claims it turned a 3-day-old V8 patch into a live Chrome exploit in under 24 hours
Description
An AI model named Cyberkimi claims to have autonomously developed a live exploit for a recently patched V8 JavaScript engine vulnerability in under 24 hours. The exploit targets Chrome Stable versions that still contain the unpatched bugs. The AI reportedly analyzed recent V8 security patches, identified incomplete fixes, and generated a working exploit chain demonstrated in a local Chromium environment. No official CVE has been assigned to these specific bugs yet, and independent confirmation is lacking. The exploit reportedly leverages a combination of aliasing bugs, race conditions, and control flow hijacking to achieve arbitrary code execution. Google has released Chrome updates addressing some V8 vulnerabilities around the same time, but it is unclear if these fixes cover the bugs exploited by Cyberkimi. This development highlights the shrinking window between patch release and exploit weaponization, potentially accelerating the risk exposure for users of affected Chrome versions.
Reddit Discussion
A malware reverse engineer and ai researcher just posted a demo claiming an AI cyber model autonomously turned a fresh V8 security fix into a working Chrome renderer exploit in under 24 hours and that the bugs are still live on shipping Chrome Stable.
Source : https://x.com/lordx64/status/2096052694326940018?s=20
The founder of Adverserial AI / CyberKimi (an unrestricted, cyber-tuned fork of Moonshot’s Kimi K3), says they trained the model on unpatched n-days and then pointed a custom harness at the latest V8 main-branch security diffs.
From the Sep 2 patch they say they pulled:
- a V8 Late Load Elimination (LLE) aliasing bug
- a SLICED-PARENT-FLIP race
Tracked internally as bugs 554421904 and 530292883.
No public CVE at time of the post.
They call it a “silent in-the-wild” chain that Stable is not protected from.
- Deterministic LLE forge → in-cage primitive
- Compose caged r/W into sandbox-wide r/W, forge an external BigUint64Array pointer, leak binary base at runtime (no baked offsets)
- RegExp calling-convention desync → PC control
- JOP gadget chain in a controlled string → system() → calculator pops
They say the whole thing was weaponized autonomously in <24 hours.
The attached video shows a local Chromium window branded “CYBERKIMI V3”, exploit logs scrolling, and a calculator. The browser is launched with --no-sandbox. Target in the overlay looks like Chromium 152.0.7977.80.
This is not a random drive-by tweet. Same account posted a similar “CyberKimi exploited CVE-2026-79236 in <24h” video on Sep 1, also with a patch-diff harness story.
Separately, Google shipped Chrome 152.0.7977.82/.83 around Sep 3–4, including CVE-2026-85046 (V8 type confusion, confirmed exploited in the wild) plus another V8 race-condition fix. Rollout is gradual.
Whether the bugs in this demo are that CVE, incomplete variants of those fixes, or something else is not independently confirmed.
The interesting part isn’t “AI wrote an exploit.” People have been chaining V8 n-days for years. The interesting part is the loop they describe:
watch V8 security diffs → variant-mine the incomplete fix → auto-weaponize → demo, inside a day.
If that loop is real and getting cheaper, the useful window between “patch lands on main” and “Stable is actually safe” keeps shrinking.
That’s the policy/engineering story, not the calc.exe clip.
Links cited in this discussion
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Cyberkimi, an AI cyber model forked from Moonshot’s Kimi K3, claims to have autonomously converted a three-day-old V8 patch into a live exploit targeting Chrome Stable within 24 hours. The AI was trained on unpatched V8 vulnerabilities and used a custom harness to analyze recent V8 main-branch security diffs, extracting bugs internally tracked as 554421904 and 530292883. The exploit chain involves a Late Load Elimination aliasing bug, a race condition, and a series of primitives culminating in arbitrary code execution demonstrated by spawning a calculator process. The demonstration used Chromium version 152.0.7977.80 launched with --no-sandbox. While Google shipped Chrome 152.0.7977.82/.83 with fixes for other V8 vulnerabilities (including CVE-2026-85046), it is not confirmed if these fixes address the bugs exploited by Cyberkimi. The key concern is the AI-driven rapid weaponization loop: monitoring V8 patches, variant mining incomplete fixes, and auto-generating exploits within a day, potentially reducing the time users remain protected after patches are released.
Potential Impact
If the claims are accurate, users running Chrome versions prior to the latest stable updates (e.g., before 152.0.7977.82/.83) remain vulnerable to a sophisticated exploit chain that can achieve arbitrary code execution via the V8 JavaScript engine. This could allow attackers to bypass sandbox protections and execute code on the host system. The rapid AI-driven exploit development shortens the window of protection after patches are published, increasing risk exposure. However, no public CVE or independent verification currently confirms the exact vulnerabilities or exploit effectiveness in the wild.
Mitigation Recommendations
Google has released Chrome versions 152.0.7977.82 and 152.0.7977.83 containing fixes for known V8 vulnerabilities around the same timeframe. Users should update to these or later Chrome versions to ensure protection against the known issues. Since the exploited bugs in the Cyberkimi demo are not independently confirmed or assigned CVEs, it is critical to apply all official Chrome updates promptly. No vendor advisory explicitly states that no action is required or that the issue is already mitigated beyond these updates. Patch status is not yet fully confirmed for the specific bugs exploited by Cyberkimi; users should monitor official Google Chrome security advisories for further details.
Technical Details
- Source Type
- Subreddit
- cybersecurity
- Reddit Score
- 0
- Discussion Level
- minimal
- Content Source
- reddit_link_post
- Post Type
- link
- Newsworthiness Assessment
- {"score":43,"reasons":["external_link","newsworthy_keywords:exploit,patch","urgent_news_indicators","established_author","very_recent"],"isNewsworthy":true,"foundNewsworthy":["exploit","patch"]}
- Has External Source
- true
- Trusted Domain
- false
Threat ID: 6a9b83d9acd9273b49f48ef2
Added to database: 09/05/2026, 02:52:09 UTC
Last enriched: 09/07/2026, 11:37:11 UTC
Last updated: 10/04/2026, 09:37:57 UTC
Views: 281
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.