I’ve seen a handful of proof of concept exploits over the years for the speculative execution bugs, none of them really worth caring about.

The most impressive was a local exploit for spectre which on certain kernel versions could leak /etc/shadow, and a similar one for windows that sometimes could leak a ntlm hash for local admin user. Both were from a commercial pentesting software company.

There’s claims of more impressive ones in academia, but no fucker in academia is sharing their code as usual.