A malware reverse engineer and ai researcher just posted a demo claiming an AI cyber model autonomously turned a fresh V8 security fix into a working Chrome renderer exploit in under 24 hours and that the bugs are still live on shipping Chrome Stable.

Source : https://x.com/lordx64/status/2096052694326940018?s=20

The founder of Adverserial AI / CyberKimi (an unrestricted, cyber-tuned fork of Moonshot’s Kimi K3), says they trained the model on unpatched n-days and then pointed a custom harness at the latest V8 main-branch security diffs.

From the Sep 2 patch they say they pulled:

• a V8 Late Load Elimination (LLE) aliasing bug
• a SLICED-PARENT-FLIP race

Tracked internally as bugs 554421904 and 530292883.

No public CVE at time of the post.

They call it a “silent in-the-wild” chain that Stable is not protected from.

1. Deterministic LLE forge → in-cage primitive
2. Compose caged r/W into sandbox-wide r/W, forge an external BigUint64Array pointer, leak binary base at runtime (no baked offsets)
3. RegExp calling-convention desync → PC control
4. JOP gadget chain in a controlled string → system() → calculator pops

They say the whole thing was weaponized autonomously in <24 hours.

The attached video shows a local Chromium window branded “CYBERKIMI V3”, exploit logs scrolling, and a calculator. The browser is launched with --no-sandbox. Target in the overlay looks like Chromium 152.0.7977.80.

This is not a random drive-by tweet. Same account posted a similar “CyberKimi exploited CVE-2026-79236 in <24h” video on Sep 1, also with a patch-diff harness story.

Separately, Google shipped Chrome 152.0.7977.82/.83 around Sep 3–4, including CVE-2026-85046 (V8 type confusion, confirmed exploited in the wild) plus another V8 race-condition fix. Rollout is gradual.

Whether the bugs in this demo are that CVE, incomplete variants of those fixes, or something else is not independently confirmed.

The interesting part isn’t “AI wrote an exploit.” People have been chaining V8 n-days for years. The interesting part is the loop they describe:

watch V8 security diffs → variant-mine the incomplete fix → auto-weaponize → demo, inside a day.

If that loop is real and getting cheaper, the useful window between “patch lands on main” and “Stable is actually safe” keeps shrinking.

That’s the policy/engineering story, not the calc.exe clip.