Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Claude Code Found a Linux Vulnerability Hidden for 23 Years

mtlynch.io

Post reply on HN
Print view View original

21–30 of 303 posts

Re: Claude Code Found a Linux Vulnerability Hidden for 23 Years

#21

Post by Serberus »

yunnpp wrote: post #7
up2isomorphism wrote: post #6

But on the other hand, Claude might introduce more vulnerability than it discovered.

Code review is the real deal for these models. This area seems largely underappreciated to me. Especially for things like C++, where static analysis tools have traditionally generated too many false positives to be useful, the LLMs seem especially good. I'm no black hat but have found similarly old bugs at my own place. Even if shit is hallucinated half the time, it still pays off when it finds that really nasty bug.…

[dead]

Re: Claude Code Found a Linux Vulnerability Hidden for 23 Years

#23

Post by NitpickLawyer »

gmerc wrote: post #9
KetoManx64 wrote: post #5

Earlier quoted context omitted.

Tokens are insanely cheap at the moment. Through OpenRouter a message to Sonnet costs about $0.001 cents or using Devstral 2512 it's about $0.0001. An extended coding session/feature expansion will cost me about $5 in credits. Split up your codebase so you don't have to feed all of it into the LLM at once and it's a very reasonable.

You’d have to ignore the massive investor ROI expectations or somehow have no capability to look past “at the moment”.

That might be a problem for the labs (although I don't think it is) but it's not a problem for end-users. There is enough pressure from top labs competing with each other, and even more pressure from open models that should keep prices at a reasonable price point going further.

In order to justify higher prices the SotA needs to have way higher capabilities than the competition (hence justifying the price) and at the same time the competition needs to be way below a certain threshold. Once that threshold becomes "good enough for task x", the higher price doesn't make sense anymore.

While there is some provider retention today, it will be harder to have once everyone offers kinda sorta the same capabilities. Changing an API provider might even be transparent for most users and they wouldn't care.

If you want to have an idea about token prices today you can check the median for serving open models on openrouter or similar platforms. You'll get a "napkin math" estimate for what it costs to serve a model of a certain size today. As long as models don't go oom higher than today's largest models, API pricing seems in line with a modest profit (so it shouldn't be subsidised, and it should drop with tech progress). Another benefit for open models is that once they're released, that capability remains there. The models can't get "worse".

Re: Claude Code Found a Linux Vulnerability Hidden for 23 Years

#24

Post by _pdp_ »

The title is a little misleading.

It was Opus 4.6 (the model). You could discover this with some other coding agent harness.

The other thing that bugs me and frankly I don't have the time to try it out myself, is that they did not compare to see if the same bug would have been found with GPT 5.4 or perhaps even an open source model.

Without that, and for the reasons I posted above, while I am sure this is not the intention, the post reads like an ad for claude code.

Re: Claude Code Found a Linux Vulnerability Hidden for 23 Years

#26

Post by mgraczyk »

_pdp_ wrote: post #24

The title is a little misleading. It was Opus 4.6 (the model). You could discover this with some other coding agent harness. The other thing that bugs me and frankly I don't have the time to try it out myself, is that they did not compare to see if the same bug would have been found with GPT 5.4 or perhaps even an open source model. Without that, and for the reasons I posted above, while I am sure this is not the int…

No the title is correct and you are misreading or didn't read. It was found with Claude code, that's the quote. This isn't a model eval, it's an Anthropic employee talking about Claude code. So comparing to other models isn't a thing to reasonably expect.

Re: Claude Code Found a Linux Vulnerability Hidden for 23 Years

#27

Post by cookiengineer »

> Nicholas has found hundreds more potential bugs in the Linux kernel, but the bottleneck to fixing them is the manual step of humans sorting through all of Claude’s findings

No, the problem is sorting out thousands of false positives from claude code's reports. 5 out of 1000+ reports to be valid is statistically worse than running a fuzzer on the codebase.

Just sayin'

Re: Claude Code Found a Linux Vulnerability Hidden for 23 Years

#29

Post by dist-epoch »

cookiengineer wrote: post #27

> Nicholas has found hundreds more potential bugs in the Linux kernel, but the bottleneck to fixing them is the manual step of humans sorting through all of Claude’s findings No, the problem is sorting out thousands of false positives from claude code's reports. 5 out of 1000+ reports to be valid is statistically worse than running a fuzzer on the codebase. Just sayin'

> On the kernel security list we've seen a huge bump of reports. We were between 2 and 3 per week maybe two years ago, then reached probably 10 a week over the last year with the only difference being only AI slop, and now since the beginning of the year we're around 5-10 per day depending on the days (fridays and tuesdays seem the worst). Now most of these reports are correct, to the point that we had to bring in more maintainers to help us. ... Also it's interesting to keep thinking that these bugs are within reach from criminals so they deserve to get fixed.

https://lwn.net/Articles/1065620/

Re: Claude Code Found a Linux Vulnerability Hidden for 23 Years

#30

Post by 112233 »

riffraff wrote: post #28
dist-epoch wrote: post #22

> "given enough eyeballs, all bugs are shallow" Time to update that: "given 1 million tokens context window, all bugs are shallow"

..and three months to review the false positives

this is always overlooked. AI stories sound like "with right attitude, you too can win 10M $ in lottery, like this man just did"

Running LLM on 1000 functions produces 10000 reports (these numbers are accurate because I just generated them) — of course only the lottery winners who pulled the actually correct report from the bag will write an article in Evening Post

Post reply on HN