An anonymous account dumped a pile of "0-days" on GitHub. The experts who read them shrugged

What an anonymous account actually published

A throwaway GitHub account published a repository it called *exploitarium*: a stack of undisclosed exploits, each with a write-up, against mostly open-source software. The author left a manifesto in the notes — "At the time I post these, none have been reported. Feel free to report them yourself and take credit for the CVE if handed out lulz. I do this to allure people into the field." On the surface it reads as a mass 0-day drop, the kind of thing that makes a security team's morning disappear. The volume and the polish are what got it to the front page in hours.

The polish is also the first clue. A surprising amount of documentation for someone supposedly throwing bombs anonymously — which is exactly what you'd expect if a model wrote the prose.

"0-day" is doing a lot of work it didn't earn

The people who do vulnerability research for a living were unimpressed before they were alarmed. The word itself is the first casualty: a 0-day is a bug exploited before anyone knew to patch it, not any exploit with a README.

"A friendly reminder that a 0-day is a vulnerability that wasn't known until after a malicious actor exploited it. If someone publishes a PoC, it is not a 0-day, just a vulnerability." — a commenter restating the definition the repo ignores

"Are they all actually 0-day? I think a lot of them are from disclosed CVEs/code that were already fixed upstream. It often seems like the term '0-day' has lost most of its meaning today." — a security commenter with \~3.5k karma

Then David Buchanan — who maintains a public blog of reverse-engineering work — opened the ones touching Ghidra, the tool he actually uses, and walked through them:

"The first requires being able to overwrite binaries in the Swift tool directory. Yes, if you overwrite binaries executed by ghidra, you can trigger code execution. This is not a surprise … The third is not a vulnerability in the slightest, they just demonstrate that native 7zip parsing code is reachable."

A second researcher put it flatly: "Pretty unimpressive as security vulnerabilities. It would be better to just say these are simple bugs for the most part."

Why a pile of weak bugs still rattled people

The reason the thread didn't simply dismiss it: aggregation changes the threat even when each piece is weak. An engineer made the FOUO argument — that public information becomes sensitive once it's gathered in one place:

"Individually these are small puzzle pieces that can't do anything. Put them all in one place and it becomes easier to … build something bigger. Now we have automatic puzzle solvers (coding assistants) [and] a repo like this becomes a lot more meaningful." — an engineer making the for-official-use-only argument

That points at the actual subject, which isn't the bugs. It's that an LLM can now grind out documented exploit attempts faster than a blue-teamer can triage them, and the asymmetry runs the wrong way. One defender, who said he'd crossed over from the offensive side, replied to the author directly: "the bad guys generally have a lot more time to scroll for new payloads than I do."

And because the timing lands in the middle of the Mythos export fight, a builder who works on LLM agents floated the cynical read — that the drop is theater:

"What if this person is from an AI lab that really wants the govt to keep suppressing Mythos/Fable & GPT5.6? It's what I would do, the timing couldn't be any better." — a developer building LLM-driven agents

No evidence backs that, and the simpler story is the one the reviewers told: a model-assisted account confused reach for exploitation, and called the result 0-days. The lasting worry isn't this repo. It's the next one, generated faster, with one real bug hidden in the pile.