Hacker News

> When you write your blog post with claude, I start hitting these phrases and then start only skimming and looking for them, and stop reading what you have to write.

I've spotted a few memes about this and can admit to doing the same..

ai;dr

(tl;dr, evolved)

If the subject seems interesting I just ask LLM to summarize in those cases, then go deeper if it ends up actually interesting or compelling.

pickle is nuts, but I can imagine dumping an entire object into the cookie while troubleshooting something then forgetting to clean it up afterwards.

This does not pass automated testing where I work let alone code review.

> how does something like this pass code and design reviews

when the "give a shit quotient" of the employee moves towards "highly engaged with the organization and its mission" to "this is just a job, I'm gonna rest and vest"

I think you're being unreasonably uncharitable. Any and all software contains bugs, and I can assure you the piece of code you wrote has bugs. My code has bugs. Google's code has bugs. iOS has bugs. rocket launching software has bugs.

We can put in systems in place to catch bugs. And that's the system that's working here.

Now to the second part of the question -

How did they not catch it before? If it were "easy", it would not have been worth 90k, and hindsight is 20/20 - once you know where to look for, it is all very very obvious.

> Do you have any advice for aspiring bug-bounty hunters?

We're probably at the end of the era of these kinds of big payouts. AI tools will drive the going rates to approximately the costs of the tokens. Bounties exist to make it nominally more economical for researchers to report exploits than it is to resell them.

People who pay bounties for vulnerabilities don’t really care how you find them.

It's hard to get a $90k bounty from Google, even with Claude in hand, so we shouldn't be dismissive of that, but it is pretty annoying to read write-ups written entirely in LLM voice.

If you're going to make this argument, at least say GLM 5.3 instead of Claude, Claude will refuse to touch anything remotely close to this unless you're in the super special club.

Shallow dismissals like this contribute nothing to the discussion.

An llm is a tool, I had access to Claude too but I didn’t find the bug. The author found it.

Research taste, among other things are still abilities that differentiate among humans.

In fact, I expect the elimination of other limiting factors by AI to lead to those becoming more important. By the same mechanism that make ugly hedge fund managers more performant.

The problem then is that composition of the top performers will change. Which is problematic since being a top performer ( ‘artist’, ‘researcher’, ‘writer’,..) is often an identity which ‘we often create to protect ourselves: the strong one who never breaks, the intelligent one who is always certain... The mask that once protected you can eventually become the cage that prevents you from changing’

You are underestimating how much effort and prior knowledge it takes to work with claude on this kind of thing.

Perhaps next time they can carve 1's and 0's by hand from a slate tablet.

Same old tired complaining about people not using technology correctly, or the way a _real_ coder would do it.

handing clients access to an LLM gets them beginner level code, easily. same with beginner level exploits. an RCE against google is not a "beginner level exploit". If you've seen AI generated code, I can tell you that AI generated security findings also have that "beginner" smell. an expert who knows what they're doing has to drive them to look at the right places, and use the experts preferred method.

I could have overlooked but doesn't seem there is a mention of Claude in the blog post? Did author say they had used Claude?

I also am wondering if Claude will proceed on a prompt which is about finding a bug like that? I am not sure, has anyone tried?

If he used an old school source code scanner would the credit go to him or to the tool? Because Claude is a tool, not a person.

;)

This is a clear example of why it is a shame we cannot block commenters on this website.

welcome to the club

Would Claude have found it without your guidance and knowledge? If yes, Claude found it. If no, you found it while using an LLM.

I suspect a lot of things fall into the latter. It is a common neg to defer everything to the former though.

If we're doing this standard, then let's do it for everything. Claude coded that, not you. Claude built that website, not you. Might make the industry less exhausting tbh.

The best response to them is "If it's so easy, then when didn't you do it? Easy $90k."

One day soon, this will be like people saying you used a high level language instead of assembly to discover a fault.

Yeah some people come off as envious they didn't have Claude try it first.

But it needs a disclosure if Claude was used: "The cookie is what caught my eye" - if that was actually Claude's eye then yeah, Simon is claiming to have a keen eye that he in fact does not.

"Claude found a $90K RCE" would have been just as interesting if not more.