It's hard to get a $90k bounty from Google, even with Claude in hand, so we shouldn't be dismissive of that, but it is pretty annoying to read write-ups written entirely in LLM voice.

Shallow dismissals like this contribute nothing to the discussion.

An llm is a tool, I had access to Claude too but I didn’t find the bug. The author found it.

Research taste, among other things are still abilities that differentiate among humans.

In fact, I expect the elimination of other limiting factors by AI to lead to those becoming more important. By the same mechanism that make ugly hedge fund managers more performant.

The problem then is that composition of the top performers will change. Which is problematic since being a top performer ( ‘artist’, ‘researcher’, ‘writer’,..) is often an identity which ‘we often create to protect ourselves: the strong one who never breaks, the intelligent one who is always certain... The mask that once protected you can eventually become the cage that prevents you from changing’

You are underestimating how much effort and prior knowledge it takes to work with claude on this kind of thing.

Perhaps next time they can carve 1's and 0's by hand from a slate tablet.

Same old tired complaining about people not using technology correctly, or the way a _real_ coder would do it.

handing clients access to an LLM gets them beginner level code, easily. same with beginner level exploits. an RCE against google is not a "beginner level exploit". If you've seen AI generated code, I can tell you that AI generated security findings also have that "beginner" smell. an expert who knows what they're doing has to drive them to look at the right places, and use the experts preferred method.

I could have overlooked but doesn't seem there is a mention of Claude in the blog post? Did author say they had used Claude?

I also am wondering if Claude will proceed on a prompt which is about finding a bug like that? I am not sure, has anyone tried?

If he used an old school source code scanner would the credit go to him or to the tool? Because Claude is a tool, not a person.

;)

This is a clear example of why it is a shame we cannot block commenters on this website.

welcome to the club