Cybersecurity researcher Mohan Pedhapati explained, demonstrated how using the Anthropic Claude Opus 4.6 AI model, he wrote a complete chain of exploits to hack the JavaScript V8 engine in Google Chrome 138, which is the current version running the Discord client.
The process of writing the exploit chain took a week, the researcher reported — throughout this, 2.3 billion tokens were consumed, costing $2,283 for access to the AI model via API; he also dedicated his own effort, spending a total of 20 hours solving deadlock issues. The cost of creating the hacking scheme is significant for an individual, acknowledged Mohan Pedhapati; on the other hand, without external assistance, a person would have worked on a similar project for several weeks. The project proved to be profitable economically — the reward from Google and Discord for reporting such an exploit could amount to around $15,000. And that is just the legal market — cybercriminals could pay even more for a zero-day vulnerability.
Many services release their applications on the Electron framework, which in turn is based on Chrome — this is done not only in Discord, but also, for example, in Slack. However, the current version of the framework lags one version behind the browser, and application developers do not always update dependencies promptly, and users do not always install the latest versions of applications. The Discord client was chosen by the expert because it runs on Chrome 138, which means it is nine major versions behind the current version of the browser.
Any budding programmer, according to Mohan Pedhapati, can exploit outdated software with enough patience and an API key for access to the AI model — "it's a matter of time, not probability." Moreover, "every patch is essentially a hint for an exploit" because open-source projects are developed transparently, meaning that fixes often become publicly available in the code even before a new version of the program is released as a whole. To protect applications from such attacks, the expert recommends closely monitoring dependencies and making changes promptly, as well as automatically releasing security patches to ensure that user software remains secure even if an update is simply forgotten. Lastly, open-source projects should be cautious when publishing detailed information about vulnerabilities.
Source:
Source: 3dnews.ru
