Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Claude Code Found a Linux Vulnerability Hidden for 23 Years

mtlynch.io

Post reply on HN
Print view View original

31–40 of 303 posts

Re: Claude Code Found a Linux Vulnerability Hidden for 23 Years

#31

Post by qsera »

yunnpp wrote: post #7
up2isomorphism wrote: post #6

But on the other hand, Claude might introduce more vulnerability than it discovered.

Code review is the real deal for these models. This area seems largely underappreciated to me. Especially for things like C++, where static analysis tools have traditionally generated too many false positives to be useful, the LLMs seem especially good. I'm no black hat but have found similarly old bugs at my own place. Even if shit is hallucinated half the time, it still pays off when it finds that really nasty bug.…

> Code review is the real deal for these models.

Yea, that is what I have been saying as well...

>Instead, people seem to be infatuated with vibe coding technical debt at scale.

Don't blame them. That is what AI marketing pushes. And people are sheep to marketing..

I understand why AI companies don't want to promote it. Because they understand that the LCD/Majority of their client base won't see code review as a critical part of their business. If LLMs are marketed as best suited for code review, then they probably cannot justify the investments that they are getting...

Re: Claude Code Found a Linux Vulnerability Hidden for 23 Years

#32

Post by addandsubtract »

jason1cho wrote: post #25

This isn't surprising. What is not mentioned is that Claude Code also found one thousand false positive bugs, which developers spent three months to rule out.

On the other hand, some bugs take three months to find. So this still seems like a win.

Re: Claude Code Found a Linux Vulnerability Hidden for 23 Years

#33

Post by mtlynch »

jason1cho wrote: post #25

This isn't surprising. What is not mentioned is that Claude Code also found one thousand false positive bugs, which developers spent three months to rule out.

> What is not mentioned is that Claude Code also found one thousand false positive bugs, which developers spent three months to rule out.

Source? I haven't seen this anywhere.

In my experience, false positive rate on vulnerabilities with Claude Opus 4.6 is well below 20%.

Re: Claude Code Found a Linux Vulnerability Hidden for 23 Years

#36

Post by r9295 »

mtlynch wrote: post #33
jason1cho wrote: post #25

This isn't surprising. What is not mentioned is that Claude Code also found one thousand false positive bugs, which developers spent three months to rule out.

> What is not mentioned is that Claude Code also found one thousand false positive bugs, which developers spent three months to rule out. Source? I haven't seen this anywhere. In my experience, false positive rate on vulnerabilities with Claude Opus 4.6 is well below 20%.

In my experience, the issue has been likelihood of exploitation or issue severity. Claude gets it wrong almost all the time.

A threat model matters and some risks are accepted. Good luck convincing an LLM of that fact

Re: Claude Code Found a Linux Vulnerability Hidden for 23 Years

#38

Post by mtlynch »

_pdp_ wrote: post #24

The title is a little misleading. It was Opus 4.6 (the model). You could discover this with some other coding agent harness. The other thing that bugs me and frankly I don't have the time to try it out myself, is that they did not compare to see if the same bug would have been found with GPT 5.4 or perhaps even an open source model. Without that, and for the reasons I posted above, while I am sure this is not the int…

OP here.

I don't understand this critique. Carlini did use Claude Code directly. Claude Code used the Claude Opus 4.6 model, but I don't know why you'd consider it inaccurate to say Claude Code found it.

GPT 5.4 might be capable of finding it as well, but the article never made any claims about whether non-Anthropic models could find it.

If I wrote about achieving 10k QPS with a Go server, is the article misleading unless I enumerate every other technology that could have achieved the same thing?

Re: Claude Code Found a Linux Vulnerability Hidden for 23 Years

#40

Post by summarity »

Related work from our security lab:

Stream of vulnerabilities discovered using security agents (23 so far this year): https://securitylab.github.com/ai-agents/

Taskflow harness to run (on your own terms): https://github.blog/security/how-to-scan-for-vulnerabilities...

Post reply on HN