GPT-5.5-Cyber built a zlib fuzzing lab in a day

Summary: In Trail of Bits' Patch the Planet collaboration with OpenAI, GPT-5.5-Cyber built a bespoke zlib fuzzing campaign in a single day that the firm says would have taken a skilled researcher weeks, producing harnesses across a dozen entrypoints, sanitizer and variant builds, seeds, and multiple findings now in coordinated disclosure. Driven through Codex with the /goal command, the model judged static review of the heavily audited zlib library a poor use of tokens, built fuzz tooling instead, and logged an inflateBack null callback crash as unreachable before finding higher-impact issues.
Key Takeaway: The expertise barrier that kept bespoke fuzzing out of reach is, in the firm's words, mostly gone: the same day-or-less capability that lets a skilled researcher audit far more code also lets a low-skill attacker get a harness off the ground, so the advantage goes to whoever finds and fixes the bugs first.

Read the original at Trail of Bits Blog ↗