Have Claude Code inspect a codebase for latent security flaws

A researcher pointed Claude Code at Linux kernel files and used it to flag serious bugs, including a 2003 NFS heap overflow.

Done with Claude Code· Advanced

What they did
Nicholas Carlini, a research scientist at Anthropic, built a small script that walked through the Linux kernel tree one file at a time. On each pass, he framed the task as a CTF challenge, hinted that the weakness lived in that file, and told Claude Code to write its strongest suspect into an output directory. After that, humans reviewed the candidates.
How it went
Claude Opus 4.6 identified several kernel vulnerabilities that could be reached remotely, among them an NFS heap overflow first introduced in 2003. Five issues were fixed or disclosed. Older models found only a small portion of the cases, and Carlini still has several hundred crashes waiting for manual review, so most findings have not been reported.
Tips
Treat the agent as a wide net, not a final judge; manual verification still decides what counts. Hold back any external report, submission, or fix until you have checked the result yourself.

Try it yourself with Claude Code

I have [open-source project or kernel subsystem] checked out at [path]. Review [directory or module] for bugs that might affect security, especially memory corruption or logic errors. For each credible finding, include the file, line number, why it matters, and a safe way to test it in an isolated environment. Sort the issues from most to least serious, and pause before any edits, deletions, submissions, or messages to maintainers until I say to continue.

Fill in the [brackets]. Agents can make mistakes, so review anything before it is sent, paid or deleted.

Read the original on mtlynch.io ↗

Get 3 agent uses like this every morning

With the day's top AI news. Free, and one click to unsubscribe.