Use an agent to trace a crypto bug from a failing test

A cryptography engineer had Claude Code inspect a failing Go implementation and pinpoint three low-level signing bugs.

Done with Claude Code· Advanced

What they did
Filippo Valsorda ran Claude Code, using Opus 4.1 without a system prompt, on a new Go ML-DSA implementation. He gave it the test command, the code path, the broken behavior, and a request to think carefully. The agent read through the code, followed the execution path, and tried out a small test to check one idea. He repeated the same approach for two earlier signing issues, starting a new session each time.
How it went
The agent identified all three bugs immediately, without outside help. One verification problem was found in minutes: the high bits were being counted twice. Its suggested patches were not good enough to keep, so Valsorda rewrote the fixes himself.
Tips
Give the agent a narrow failing test and clear file location. For separate bugs, start over with a fresh session, and treat its answer as a clue to investigate, not a patch to apply blindly.

Try it yourself with Claude Code

I have a failing test in [path/to/code] for [describe the bug or wrong output]. Use [test command] to reproduce it, inspect the implementation, and compare it with [reference code, spec, or test vectors]. Trace the root cause carefully, and if needed, run a small focused test to check a hypothesis. Stop before changing any files and show me the exact fix you would make; I’ll approve it before you edit anything.

Fill in the [brackets]. Agents can make mistakes, so review anything before it is sent, paid or deleted.

Read the original on words.filippo.io ↗

Get 3 agent uses like this every morning

With the day's top AI news. Free, and one click to unsubscribe.