Agree, it seems that the LLM was able to crack the typical exploits found on weak websites that has never seen the light of the OWASP10. The paper also lists that the pages was greatly cherrypicked for testing the hypothesis, which indicate while it is possible, it is not a breakthrough.