Three AI Hackers Put to the Test: Codex's Quick Breakthrough, Claude's Stall, Gemini's Refusal

A Non-Ranking AI Hacking Experiment

On October 18, the bug bounty platform YesWeHack released an interesting test: three mainstream coding AIs were each asked to try to hack a test website. The results varied dramatically—Codex independently unearthed its first vulnerability in under four minutes, Claude stalled for 20 minutes before requiring human intervention, and Gemini CLI outright refused to attack even with explicit authorization.

A key caveat up front: each AI ran only once, against a different vulnerability target. So this isn't a performance ranking—it's an observation of behavioral patterns. The distinct "personalities" these three tools displayed may be more interesting than who was faster or slower.

The Product Logic Behind Three Reactions

Codex: The Speedster

Codex's performance came closest to what you'd expect from an "automated penetration testing tool." Without any human intervention, it located and exploited an initial vulnerability within four minutes. This efficiency has clear value for repetitive scanning and matching known vulnerability patterns.

But a single success doesn't prove reliability. In real penetration testing, vulnerabilities are often chained—a low-severity entry point needs to be combined with multiple conditions to escalate into a high-severity issue. Whether AI can maintain reasoning coherence across complex chains is a question this test didn't answer.

Vulnerability Chain refers to the process by which an attacker links multiple individually low- or medium-severity issues together, gradually escalating privileges or expanding impact to ultimately achieve a high-severity objective. For example, an information disclosure vulnerability might provide an internal path, which combined with a weak authentication flaw enables unauthorized access. Chained exploitation requires the attacker to have global reasoning ability: remembering findings from the previous step, inferring possible entry points for the next, and maintaining logical consistency throughout a long process. Current AI performs well at single-point vulnerability matching but tends to lose context or hallucinate during multi-step chain reasoning. This is why the article emphasizes that "a single success doesn't prove reliability"—the real difficulty in penetration testing often lies not in finding the first vulnerability, but in piecing fragments into a complete attack path.

Claude: Stalls, Then Asks for Help

After 20 minutes of attempts, Claude couldn't complete the task independently and ultimately needed human assistance. That result isn't shameful in itself—hitting bottlenecks is normal in security testing. What's interesting is how it got "stuck": it didn't try randomly, nor did it give up—it stalled at a certain point and waited for external input.

For practical workflows, this "knowing what it doesn't know" behavior pattern may be more valuable than blind attempts. It means humans can intervene at critical decision points rather than being led astray by AI's confident errors.

Gemini CLI: Refuses Even With Authorization

Gemini CLI's reaction was the most unexpected: even with explicit authorization in the test environment, it still refused to execute attack operations. This reflects model-level safety alignment strategies at work—its semantic sensitivity to "hacking behavior" may be higher than its recognition of "authorization context."

This over-refusal is a double-edged sword in real security work. If enterprise red teams use Gemini-series models, they may need additional prompt engineering or policy configuration to override misjudgments—otherwise they'll frequently hit walls in legitimately authorized scenarios.

Bug Bounty is a crowdsourced security testing mechanism: enterprises or platforms publicly authorize white-hat hackers to find vulnerabilities within a specified scope and pay bounties based on severity. YesWeHack is a well-known European bug bounty platform whose business model is built on the legal framework of "authorized testing"—participants must strictly comply with scope and rules, or they may be committing unauthorized intrusion. The reason this experiment emphasizes "authorization" is precisely because the core ethical and legal prerequisite of bug bounty is informed consent; unauthorized attacks constitute criminal offenses in most jurisdictions. Understanding this is essential to appreciating why Gemini CLI's refusal sparked discussion: it prioritized the semantic signal of "attack behavior" over "authorization context," and the latter is precisely the cornerstone of legitimate security testing.

Safety Alignment refers to behavioral constraints implanted in models during training through techniques such as reinforcement learning from human feedback (RLHF), aimed at making models refuse harmful requests like generating malware or conducting cyberattacks. However, alignment strategies are often based on semantic pattern matching rather than deep understanding of true intent and context, making them prone to over-refusal: when requests contain sensitive words like "intrusion," "attack," or "exploit," models may trigger refusals even in legitimately authorized scenarios. This creates friction in professional contexts like red teaming and penetration testing. Mitigation approaches include clearer authorization statements, role-setting prompts, and platform-level policy whitelists, but fundamentally models still need to improve their ability to recognize "authorization context."

Practical Implications for Security Professionals

YesWeHack's conclusion is pragmatic: AI accelerates vulnerability discovery, but humans remain the ultimate validators of vulnerabilities. This isn't a denial of AI capabilities but an accurate description of the current human-machine division of labor.

Specifically, AI excels at: rapidly enumerating attack surfaces, matching known vulnerability patterns, and generating test payloads. What humans irreplaceably provide: judging the business impact of vulnerabilities, constructing complex exploitation chains, and making decisions at legal and ethical boundaries.

If you want to integrate AI into your security testing workflow, consider these directions:

• Define authorization boundaries clearly: Describe target scope and authorization basis explicitly in prompts to reduce model safety misjudgments
• Retain human review checkpoints: Position AI as a "discoverer" rather than a "decision-maker"; all high-risk operations require human confirmation
• Train intuition in legal environments: Free labs like PortSwigger's Web Security Academy are low-risk options for getting familiar with AI-assisted penetration testing rhythms

Should AI Refuse Hacking Behavior?

This test raises a question with no standard answer. From a safety alignment perspective, Gemini's refusal is responsible behavior—offensive capabilities shouldn't be easily released. But from a professional tool perspective, authorized security testing is fundamentally different from malicious attacks, and models need to learn to distinguish between them.

The current reality is: refusal thresholds vary widely across models, and users need to choose tools based on specific scenarios rather than expecting one model to behave consistently across all situations. Codex's "cooperation," Claude's "caution," and Gemini's "refusal" are essentially projections of three different product philosophies onto the security domain.

For ordinary developers and security enthusiasts, the biggest takeaway from this experiment may be: AI can help you find problems faster, but proving that a problem truly exists, assessing its harm, and deciding how to fix it remains human work.

One-line Summary

YesWeHack had three AIs each attempt one intrusion: Codex was fast, Claude asked for help, Gemini refused to attack.

Paragraph Summary

YesWeHack had Codex, Claude, and Gemini CLI each run one intrusion test against different targets with only one sample each, so this isn't a performance ranking but an observation of behavioral patterns. Codex independently found its first vulnerability in under four minutes, demonstrating automated scanning efficiency; Claude stalled for 20 minutes before requiring human intervention, embodying the caution of "knowing when to stop"; Gemini CLI refused to attack even with explicit authorization, exposing the over-refusal problem caused by safety alignment. The article argues that AI excels at rapidly enumerating attack surfaces, matching known vulnerabilities, and generating payloads, but humans remain the ultimate validators of vulnerabilities, responsible for judging business impact, constructing complex exploitation chains, and making decisions at legal and ethical boundaries. Practitioners should position AI as a discoverer rather than a decision-maker, define authorization boundaries clearly, and retain human review checkpoints.