I replicated this experiment on several production codebases and got several crits. Lots of dupes, lots of false positives, lots of bugs that weren't actually exploitable, lots of accepted/ known risks. But also, crits!
Claude Code Found a Linux Vulnerability Hidden for 23 Years
101–110 of 303 posts
Re: Claude Code Found a Linux Vulnerability Hidden for 23 Years
#102This isn't surprising. What is not mentioned is that Claude Code also found one thousand false positive bugs, which developers spent three months to rule out.
The article doesn't say they found a bunch of false positives. It says they have a huge backlog that they still need to test: "I have so many bugs in the Linux kernel that I can’t report because I haven’t validated them yet…"
[dead]
Re: Claude Code Found a Linux Vulnerability Hidden for 23 Years
#103Pasting a big batch of new code and asking Claude "what have I forgotten? Where are the bugs?" is a very persuasive on-ramp for developers new to AI. It spots threading & distributed system bugs that would have taken hours to uncover before, and where there isn't any other easy tooling. I bet there's loads of cryptocurrency implementations being pored over right now - actual money on the table.
> Pasting a big batch of new code and asking Claude "what have I forgotten? Where are the bugs?" It's actually the main way I use CC/codex.
[dead]
Re: Claude Code Found a Linux Vulnerability Hidden for 23 Years
#104This does sound great, but the cost of tokens will prevent most companies from using agents to secure their code.
Tokens are insanely cheap at the moment. Through OpenRouter a message to Sonnet costs about $0.001 cents or using Devstral 2512 it's about $0.0001. An extended coding session/feature expansion will cost me about $5 in credits. Split up your codebase so you don't have to feed all of it into the LLM at once and it's a very reasonable.
Agentic tasks use up a huge amount of tokens compared to simple chatting. Every elementary interaction the model has with the outside world (even while doing something as simple as reading code from a large codebase) is a separate "chat" message and "response", and these add up very quickly.
Re: Claude Code Found a Linux Vulnerability Hidden for 23 Years
#105Earlier quoted context omitted.
To the issue of AI submitted patches being more of a burden than a boon, many projects have decided to stop accepting AI-generated solutioning: https://blog.devgenius.io/open-source-projects-are-now-banni... These are just a few examples. There are more that google can supply.
No, they haven't. Read the ai slop you posted carefully. It's a policy update that enables maintainers to ignore low effort "contributions" that come from untrusted people in order to reduce reviewing workload. An Eternal September problem, kind of.
Didn't you just restate what the parent claimed?
Re: Claude Code Found a Linux Vulnerability Hidden for 23 Years
#106Earlier quoted context omitted.
In TFA: I have so many bugs in the Linux kernel that I can’t report because I haven’t validated them yet… I’m not going to send [the Linux kernel maintainers] potential slop, but this means I now have several hundred crashes that they haven’t seen because I haven’t had time to check them. —Nicholas Carlini, speaking at [un]prompted 2026
Those aren't false positives; they're results he hasn't yet inspected. I wrote a longer reply here: https://news.ycombinator.com/item?id=47638062
>Those aren't false positives; they're results he hasn't yet inspected.
It's not a XOR
Re: Claude Code Found a Linux Vulnerability Hidden for 23 Years
#107Re: Claude Code Found a Linux Vulnerability Hidden for 23 Years
#108Re: Claude Code Found a Linux Vulnerability Hidden for 23 Years
#109This isn't surprising. What is not mentioned is that Claude Code also found one thousand false positive bugs, which developers spent three months to rule out.
[dead]
Re: Claude Code Found a Linux Vulnerability Hidden for 23 Years
#110A developer using Claude Code found this bug. Claude is a tool. It is used by developers. It should not sign commits. Neovim never tried to sign commits with me, nor Zed.