Opinion: Can AI hack 99% of the internet? Marian Sorca’s take

Marian Sorca believes leading AI companies, using their strongest models with enough agents, computing resources, time, and expert direction, may already be capable of hacking an overwhelming share of what is connected to the internet.

In his own words: “99%.”

That percentage is his personal intuition, not a measured statistic. His assessment comes from working in software since 2010 and using AI in software development. He claims no insider information about private models, undisclosed vulnerabilities, or operations inside AI companies.

The event that prompted his latest public argument was XBOW’s announcement of an AI-assisted Chrome exploit. But his broader concern goes beyond that demonstration: the model involved was GPT-5.6 Sol, rather than newer models such as GPT-6 Astra or GPT-6.1 Sol.

What XBOW demonstrated with GPT-5.6 Sol

On October 13, 2026, XBOW announced a $250,000 reward from Google for a full-chain Chrome exploit developed by a security researcher working with AI agents powered by OpenAI’s GPT-5.6 Sol.

According to XBOW, the awarded chain took six days to build, with approximately $40,000 in API costs. It combined three vulnerabilities to demonstrate code execution outside Chrome’s renderer sandbox on Windows.

XBOW says Google confirmed the findings and shipped fixes. The company also says the vulnerabilities were never used against Chrome users. Its estimate of a billion potentially affected users describes potential exposure before the fixes, rather than a billion actual compromises.

The work involved substantial human expertise. Researchers directed the agents, evaluated findings, and integrated the results. The six-day campaign followed earlier research; it was not the entire project starting from nothing.

For Marian, those qualifications do not diminish the central development: AI agents contributed to a serious exploit against a widely used browser with multiple security boundaries.

His point: this was not even one of the newer models

Marian specifically draws attention to the model used: GPT-5.6 Sol.

His original post contrasted that result with GPT-6 Astra and GPT-6.1 Sol. OpenAI’s current model documentation identifies Astra as its flagship for complex reasoning and coding, and GPT-6.1 Sol as a model balancing intelligence and cost.

The question Marian raises is straightforward: if an earlier model can contribute to this result under expert direction, what might newer systems accomplish with the right tools and resources?

A newer model name alone does not establish better performance on every security task. That requires evaluation.

However, there is relevant public evidence beyond model naming. In its “Path to Astra” assessment, OpenAI states that Astra reaches its Critical cybersecurity capability threshold. OpenAI describes this as the ability, with appropriate tools and access, to discover unknown vulnerabilities and develop exploits across many well-protected systems without human guidance at every step.

That assessment supports taking advanced AI cyber capabilities seriously. It does not establish Marian’s “99%” figure.

Why software has shaped his view since 2010

Marian started working with software in 2010. He describes it as his main professional focus and a sustained personal passion, built through years of learning, development, debugging, and maintaining applications.

His work includes client projects through abZ Global and building SelfManager.ai.

That experience has given him a practical understanding of how software components depend on one another: interfaces, databases, authentication, APIs, cloud services, integrations, and permission systems.

From that perspective, software security depends on the behavior of the entire system. A feature can work correctly during normal use while an overlooked interaction creates an opening elsewhere.

A permission check can be incomplete. An integration can receive excessive access. A dependency can introduce a weakness. Two individually limited problems can interact in a more serious way.

His concern is that capable AI agents can help investigate these relationships repeatedly and at scale.

Software development experience is the basis for his reasoning. It is not a substitute for security testing or evidence of a worldwide compromise rate.

Working with AI changed how he thinks about the problem

Marian also bases his view on using AI in development as coding tools expanded toward multi-file editing and agentic workflows.

The timeline is worth clarifying: Copilot’s multi-file editing features arrived in late 2024, while GitHub announced VS Code agent mode in February 2025.

The meaningful shift for his argument is from generating isolated code suggestions to investigating problems across multiple files and carrying out sequences of work.

With suitable tools, an agent can inspect context, propose an explanation, test it, examine the result, and try again. Marian sees a direct connection between that development workflow and vulnerability research.

His inference is that the ability to understand and repair software can also contribute to finding ways software fails under unexpected conditions.

Public safety measures affect what users see

Another part of Marian’s argument concerns the difference between technical capability and what a public product permits.

Leading AI developers publish information about safeguards intended to reduce harmful use. OpenAI describes layered defenses involving safety training, monitoring, evaluations, and other controls.

For Astra specifically, OpenAI says it strengthened safeguards against cyber misuse and unauthorized actions, including protections during development and deployment.

A public assistant’s refusal to perform a harmful task therefore cannot, by itself, establish that the underlying model lacks the relevant technical knowledge or reasoning ability.

Equally, a refusal does not prove that the model could successfully perform that task. Permission boundaries and capability assessments answer different questions.

Marian believes discussions about AI hacking often overlook that distinction. What an ordinary user can get a public assistant to do is an incomplete measure of what a model can accomplish in a controlled research setting.

What about more powerful models inside the labs?

Marian also suspects leading AI companies may have more capable systems internally than those available to the public.

There is public documentation of internal development and testing before release. OpenAI describes evaluating capabilities throughout training and deployment, and applying safeguards to internal use of advanced systems.

That establishes the existence of internal development stages. It does not establish that every company currently possesses a substantially stronger secret model.

Marian’s further belief is an inference: companies developing the next generation may already be testing systems, checkpoints, or configurations that exceed what public users can access in some areas.

He has no insider knowledge of those systems and cannot quantify any capability gap.

His argument does not require assuming unlimited hidden capabilities. The demonstrated public capabilities already concern him; the possibility of stronger internal systems adds uncertainty.

What “99%” means in this argument

Marian uses “99%” to express how broad he believes the potential exposure could be. There is no representative study or benchmark behind that exact percentage.

His underlying hypothesis is that leading AI companies, given sufficient resources, coordination, access, and expert direction, could find practical routes to compromise across an overwhelming share of connected software environments.

Important limits remain:

  • Discovering a vulnerability differs from producing a reliable exploit.
  • Compromising one component differs from taking over an organization.
  • Source-code access can make investigation easier than remote access alone.
  • Isolation, access controls, and other defenses can block an otherwise capable system.
  • More agents and compute do not guarantee success.

The Chrome result cannot establish that every smaller business is easier to hack. Different systems present different opportunities and barriers.

His percentage should be understood as a strongly expressed personal judgment that remains open to challenge.

Technical capability does not imply malicious intent

Marian’s original post made this distinction explicitly:

“That doesn’t mean they will. I just said that technically they can.”

He is not alleging that leading AI companies are secretly attacking businesses, financial institutions, hospitals, governments, or infrastructure operators.

His argument concerns the capabilities they may possess and the implications for organizations relying on connected software.

The same tools can help defenders investigate their own systems, verify weaknesses, and develop repairs. XBOW’s reported disclosure led to fixes, illustrating that defensive opportunity.

Marian also points out that this result required no quantum computer. AI-assisted investigation of software vulnerabilities is a separate issue from quantum threats to cryptography.

For business owners and software builders, his concern is whether security practices are adapting to capabilities already being demonstrated.

Frequently asked questions

Does Marian Sorca have proof that AI companies can hack 99% of the internet?

No. The percentage expresses his personal intuition, based on software experience and AI development work. It is not a verified statistic.

Why does he emphasize GPT-5.6 Sol?

Because XBOW reported using that model, while newer models such as GPT-6 Astra and GPT-6.1 Sol are now available. He sees the result as a reason to examine what newer systems can do.

Do AI companies apply safety measures to public models?

Yes. Developers publish descriptions of safeguards intended to reduce harmful use. The existence of safeguards does not establish a particular model’s success rate on hacking tasks.

Is it confirmed that labs have much stronger private models?

Internal development and pre-release testing are documented. The claim that current private systems are substantially stronger than public ones is Marian’s inference, not an independently established fact in this article.

Is this based on insider information?

No. Marian attributes his view to software experience since 2010, his work with AI development tools, and publicly available information.

Source notes

Public sources checked October 14, 2026. The “99%” assessment and the proposed private capability gap are Marian’s opinions, not findings established by these sources.