Four security numbers that cannot be called real-world exploit rates

A security result can be dramatic and still answer a narrower question than its headline suggests. One measured attempt may not have succeeded. A verified laboratory exploit may never have reached production. Zero missed attacks on a benchmark does not predict all future attacks. And an answer copied from a public exploit database is not the same as fresh vulnerability reasoning.

ELLIO reports intercepting a roughly 23.07 MB Node2Shell Brotli payload on October 26, targeting Node.js 24.22.0. Its controlled exploit reproduction supports a serious code-execution path on that build. It is crucial to retain two records: the attack arriving at a sensor, and the effect reproduced in the lab. Neither alone proves a production victim executed the payload successfully.

Aditya Oke and coauthors developed Ulysses, which forms exploit hypotheses, tests them in isolated app environments, inspects observable effects and revises its plan. The reported result is ten verified reproductions among 25 selected real application advisories, with four additional proof paths. The extra paths must not be counted as four newly assigned CVEs unless a separate disclosure establishes that identity.

Ilaria Campestrini and colleagues built WADE using per-application WebAssembly function-call sequences. The study reports zero missed attacks and 0.42 percent false positives across a selected set of 67 applications and ten classes. A detector dependent on execution traces may not see an attack that leaves those traces unchanged. The correct claim is about the tested distribution, not a universal WebAssembly detection guarantee.

Zifan Peng and colleagues built CONSTRAINTDIAL from 203 public smart-contract cases into 3,045 tasks whose verified mutations preserve security-relevant properties while invalidating copied reference answers. They report an approximately 10.9-point reduction in success by reusing public answers and a 9.3-point reduction in acceptance of copied online solutions. That is evidence of reduced answer reuse under tested changes, not a proof that no remaining example leaked into a model's training data.

The rigorous comparison is not which percentage is larger. It is which effect the tester independently observed, which environment was available, and whether the test would still work on a withheld example. These reports give practical evidence checks; they do not share a population from which a global AI-security success rate can be computed.