Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Claude Code Found a Linux Vulnerability Hidden for 23 Years

mtlynch.io

Post reply on HN
Print view View original

51–60 of 303 posts

Re: Claude Code Found a Linux Vulnerability Hidden for 23 Years

#51

Post by red75prime »

112233 wrote: post #30
riffraff wrote: post #28

Earlier quoted context omitted.

..and three months to review the false positives

this is always overlooked. AI stories sound like "with right attitude, you too can win 10M $ in lottery, like this man just did" Running LLM on 1000 functions produces 10000 reports (these numbers are accurate because I just generated them) — of course only the lottery winners who pulled the actually correct report from the bag will write an article in Evening Post

> these numbers are accurate because I just generated them

Is it sarcasm, or you really did this? Claude Opus 4.6?

Re: Claude Code Found a Linux Vulnerability Hidden for 23 Years

#52

Post by weird-eye-issue »

_pdp_ wrote: post #24

The title is a little misleading. It was Opus 4.6 (the model). You could discover this with some other coding agent harness. The other thing that bugs me and frankly I don't have the time to try it out myself, is that they did not compare to see if the same bug would have been found with GPT 5.4 or perhaps even an open source model. Without that, and for the reasons I posted above, while I am sure this is not the int…

> You could discover this with some other coding agent harness.

And surely that would be relevant if they were using a different harness.

Re: Claude Code Found a Linux Vulnerability Hidden for 23 Years

#53

Post by weird-eye-issue »

sva_ wrote: post #34
jason1cho wrote: post #25

This isn't surprising. What is not mentioned is that Claude Code also found one thousand false positive bugs, which developers spent three months to rule out.

Couldn't you just make it write a PoC?

Still have to validate it.

Re: Claude Code Found a Linux Vulnerability Hidden for 23 Years

#55

Post by christophilus »

mtlynch wrote: post #33
jason1cho wrote: post #25

This isn't surprising. What is not mentioned is that Claude Code also found one thousand false positive bugs, which developers spent three months to rule out.

> What is not mentioned is that Claude Code also found one thousand false positive bugs, which developers spent three months to rule out. Source? I haven't seen this anywhere. In my experience, false positive rate on vulnerabilities with Claude Opus 4.6 is well below 20%.

Same. Codex and Claude Code on the latest models are really good at finding bugs, and really good at fixing them in my experience. Much better than 50% in the latter case and much faster than I am.

Re: Claude Code Found a Linux Vulnerability Hidden for 23 Years

#56

Post by christophilus »

lebovic wrote: post #8
KetoManx64 wrote: post #5

Earlier quoted context omitted.

Tokens are insanely cheap at the moment. Through OpenRouter a message to Sonnet costs about $0.001 cents or using Devstral 2512 it's about $0.0001. An extended coding session/feature expansion will cost me about $5 in credits. Split up your codebase so you don't have to feed all of it into the LLM at once and it's a very reasonable.

It cost me ~$750 to find a tricky privilege escalation bug in a complex codebase where I knew the rough specs but didn't have the exploit. There are certainly still many other bugs like that in the codebase, and it would cost $100k-$1MM to explore the rest of the system that deeply with models at or above the capability of Opus 4.6. It's definitely possible to do a basic pass for much less (I do this with autopen.dev…

This is where the Codex and Claude Code Pro/Max plans are excellent. I rarely run into the limits of Codex. If I do, I wait and come back and have it resume once the window has expired.

Re: Claude Code Found a Linux Vulnerability Hidden for 23 Years

#57

Post by mattbee »

Pasting a big batch of new code and asking Claude "what have I forgotten? Where are the bugs?" is a very persuasive on-ramp for developers new to AI. It spots threading & distributed system bugs that would have taken hours to uncover before, and where there isn't any other easy tooling.

I bet there's loads of cryptocurrency implementations being pored over right now - actual money on the table.

Re: Claude Code Found a Linux Vulnerability Hidden for 23 Years

#58

Post by Pikamander2 »

ThePowerOfFuet wrote: post #15
KetoManx64 wrote: post #5

Earlier quoted context omitted.

Tokens are insanely cheap at the moment. Through OpenRouter a message to Sonnet costs about $0.001 cents or using Devstral 2512 it's about $0.0001. An extended coding session/feature expansion will cost me about $5 in credits. Split up your codebase so you don't have to feed all of it into the LLM at once and it's a very reasonable.

>$0.001 cents $0.001 (1/10 of a cent) or 0.001 cents (1/1000 of a cent, or $0.00001)?

Oh no, here we go again

https://youtube.com/watch?v=MShv_74FNWU

Re: Claude Code Found a Linux Vulnerability Hidden for 23 Years

#59

Post by boplicity »

jason1cho wrote: post #25

This isn't surprising. What is not mentioned is that Claude Code also found one thousand false positive bugs, which developers spent three months to rule out.

The lesson here shouldn't be that Claude Code is useless, but that it's a powerful tool in the hands of the right people.
Post reply on HN