A new benchmark published around Infosecurity Europe has confirmed something many security practitioners suspected but few had hard evidence for: frontier AI models can autonomously develop working exploits for real-world vulnerabilities. The headline is not which model wins a head-to-head. The headline is that both can do it at all.

For organisations deploying large language models (LLMs) in any capacity, this is a governance moment, not just a threat intelligence footnote.

What the Benchmark Actually Demonstrates

The benchmark tested whether models could go beyond identifying known vulnerabilities and actually produce functional browser exploits autonomously. Some models did this more reliably out of the box. Others required more scaffolding from the operator but reached comparable outcomes when configured correctly. Separately, both models have been shown to find zero-day vulnerabilities in codebases that survived decades of human audit review.

Two things make this significant. First, the barrier to entry for adversarial exploit development just dropped considerably. Second, if your organisation is running an LLM with access to internal code repositories, ticketing systems, or infrastructure tooling, the attack surface is no longer purely external.

The Dual-Use Problem at the Heart of AI Risk

LLMs are dual-use by nature. The same capability that lets a model assist a penetration tester write a proof-of-concept exploit can be turned against an organisation’s own systems, either through misuse by an insider or through prompt injection by an external attacker. This is not theoretical. Prompt injection attacks against AI agents have already been demonstrated in production environments.

The benchmark results sharpen this risk in a specific way: you may now be deploying a tool that, under the wrong conditions, is capable of autonomous vulnerability discovery and exploitation. Whether that capability sits inside your security operations centre as a force multiplier or becomes a liability depends entirely on how you govern and constrain the model.

Where ISO 42001 Fits

ISO 42001, the international standard for AI management systems, exists precisely to address this kind of risk. It asks organisations to establish a governed framework around AI development and deployment, covering intended use, risk assessment, impact evaluation, and ongoing monitoring. For LLM deployments specifically, a conformant AI management system should address several areas:

  • Intended use boundaries — Has the organisation formally defined what the LLM is permitted to do, and documented what it must not be used for? If a model has code execution access, that scope needs explicit governance.
  • AI risk assessment — ISO 42001 requires proportionate risk assessment before deployment. The benchmark results are new evidence that should feed directly into any existing AI risk register covering models with access to code or infrastructure.
  • Supplier and third-party considerations — If you are consuming frontier models via API, your AI management system needs to address how you evaluate the capabilities and limitations of those models, including offensive capabilities.
  • Monitoring and incident response — Ongoing monitoring of AI system behaviour is a core ISO 42001 requirement. Organisations should have detection controls in place to identify anomalous model outputs, particularly where models are agentic or have tool-use capabilities.

Where ISO 27001 Takes Over

ISO 27001 provides the information security management system framework that should underpin how LLMs are integrated into your environment. The 2022 revision of the standard introduced Annex A controls that are particularly relevant here.

  • A.8.28 (Secure coding) — If a model is assisting with software development, the outputs need to be treated as untrusted code until reviewed. Automated code suggestions from LLMs should feed into your existing secure development lifecycle, not bypass it.
  • A.8.25 (Secure development lifecycle) — The use of AI in vulnerability research or code analysis should be governed within your SDLC controls, with clear ownership of outputs.
  • A.5.23 (Information security for use of cloud services) — Most frontier LLM access is cloud-delivered. Data classification, prompt content controls, and retention policies all fall under this control.
  • A.8.16 (Monitoring activities) — Behavioural monitoring of AI agents interacting with systems is a natural extension of your existing monitoring controls.

The practical point is that ISO 27001 already gives you the control framework. What the new benchmark results do is tell you which controls need revisiting and which risks need uprating in your next risk assessment cycle.

Practical Steps for Security Leaders Right Now

You do not need to wait for your next certification audit to act on this. There are immediate governance steps that make sense regardless of where you are in your ISO journey.

  1. Revisit your AI risk register. If you have one, the benchmark results are material new information. If you do not have one, start with a simple asset-based assessment: which LLMs are deployed, what data and systems can they access, and what is the blast radius if the model is misused or compromised.
  2. Apply least privilege to model integrations. Any LLM with tool-use or agentic capabilities should operate under the principle of least privilege. Restrict what APIs, repositories, and systems the model can interact with to only what is genuinely necessary.
  3. Treat prompt injection as a first-class threat. If you are deploying AI agents that process external input — emails, documents, web content — prompt injection is a realistic attack vector. Include it in your threat modelling.
  4. Review your acceptable use policy for AI tools. Employees using frontier AI models for security research, code review, or penetration testing need clear guidance on what is permissible and what controls apply to outputs.
  5. Map your AI governance to ISO 42001 clauses. Even if formal certification is not on the immediate roadmap, using the ISO 42001 structure as a maturity reference helps identify gaps and provides a defensible audit trail.

A Note on Proportionality

Not every organisation faces the same exposure. A business running a customer-facing chatbot with no code or infrastructure access sits in a very different risk position from a software company using an agentic LLM to assist with vulnerability scanning. Proportionality is a core principle in both ISO 27001 and ISO 42001, and the governance response should match actual risk rather than headline anxiety.

What the benchmark results do change is the baseline assumption. Until recently, it was reasonable to treat autonomous exploit development as a capability requiring significant specialist effort. That assumption no longer holds for organisations using frontier models. The governance frameworks exist to help you manage this proportionately and credibly. The question is whether you are using them.