# Fact: Frontier AI found the flaw ahead of attackers, giving defenders time to prepare

> Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source.

Frontier AI found the flaw ahead of attackers, giving defenders time to prepare Who says it, its status (disputed), its sources, and its timeline from publication to this site.

Fact · discovery · disputed

# Frontier AI found the flaw ahead of attackers, giving defenders time to prepare

**Who says it:** OpenAI · **Sources:** [OpenAI on X](../../sources/x-openai-php2shell/index.html) [THN](../../sources/thehackernews-php2shell-4days/index.html)

Amazon reports an exploit attempt against a honeypot on 17 October, four days before disclosure, from an actor whose source of exploit information is unknown.

## Fact-check

**A2** Reported●●○○○○ opinion disputed · Opinion · verdict: **holds in part**

OpenAI's post carries the sentence, but with the qualifier 'to our knowledge' that the claim drops. As a reading it rests on one interested party; the only counter-evidence (Amazon's 17 October honeypot hit) reaches the vault second-hand via The Hacker News, and it shows attackers had exploit information before disclosure, not before AI found the bug.

| Capture checked | Result | What it says | sha256 of the text read |
|---|---|---|---|
| [x-openai-php2shell](../../sources/x-openai-php2shell/index.html) | carries | *to our knowledge, frontier AI was able to find this vulnerability ahead of attackers, giving defenders time to prepare.* | 785b7cae55e3748b |
| [thehackernews-php2shell-4days](../../sources/thehackernews-php2shell-4days/index.html) | partial | *it remains unclear how the actor acquired exploit information prior to disclosure.* | c1cb63141287484c |

Open tickets: [Finding-58](../../factcheck/index.html#Finding-58), [Finding-7](../../factcheck/index.html#Finding-7).

Graded in Run-1, resting on captures up to 2026-10-22 08:16 UTC. The scale is on [the fact-check page](../../factcheck/index.html#ladder).

## This fact over time
- 2026-10-21 14:04 UTCOpenAI on X publishes [OpenAI on X: OpenAI models helped researchers ... discover critical security flaws in PHP](../../sources/x-openai-php2shell/index.html)
- 2026-10-22THN publishes [Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly Disclosed](../../sources/thehackernews-php2shell-4days/index.html)
- 2026-10-22 08:13 UTCSaved into the evidence vault: THN
- 2026-10-22 08:16 UTCSaved into the evidence vault: OpenAI on X
- 2026-10-22Enters this site as disputed in v0.1.0 (reconstructed from git)

Published: when the source says it was published. Saved: the first capture into the evidence vault. The rest are this site: the release in which the fact first appeared and every release that changed its wording, sources or status.

## What it rests on

## Where this fact appears

In the briefings for:
RRowanJournalistAAshSecurity researcherBBlakeAnalyst or policy advisorRRileyCommunications team
And on [every claim](../../claims/index.html#ahead-of-attackers).

## Every version of this fact
v1 · site v0.1.0 · 22 October 2026 · disputed
```
Frontier AI found the flaw ahead of attackers, giving defenders time to prepare
Who says it: OpenAI
Status: disputed
Topic: discovery
Sources: x-openai-php2shell, thehackernews-php2shell-4days
```


---
site v0.8.0 · data as of 2026-10-22T11:34Z · vault commit 200d08971937 · https://php.oct.2026.newsroom.sgit.ai/facts/ahead-of-attackers/index.html