I honestly wonder how many of these are written by LLMs. Without code review, Opus would have introduced multiple zero day vulnerabilities into our codebases. The funniest one: it was meant to rate-limit brute-force attempts, but on a failed check it returned early and triggered a rollback. That rollback also undid the increment of the attempt counter so attackers effectively got unlimited attempts.

When I read stuff like this, I have to assume that the blackhats have already been doing this, for some time.

It's not really worth much when it doesn't work most of the time though:

https://github.com/anthropics/claude-code/issues/18866 https://updog.ai/status/anthropic

In so far as model use cases I don't mind them throwing their heads against the wall in sandboxes to find vulnerabilities but why would it do that without specific prompting? Is anthropic fine with claude setting it's own agendas in red-teaming? That's like the complete opposite of sanitizing inputs.

Have they been verified?

Wasn't this Opus thing released like 30 minutes ago?

Well, I guess I know what I'm doing for the first hour when 4.7 comes out.

Did they submit 500 patches?

How can an LLM uncover 500 zero day flaws in open source? It puts them there in the first place.