Claude Code Found a Linux Vulnerability Hidden for 23 Years

Nicholas Carlini, a research scientist at Anthropic, reported at the [un]prompted AI security conference that he used Claude Code to find multiple remotely exploitable security vulnerabilities in the Linux kernel, including one that sat undiscovered for 23 years. Nicholas was astonished at how effective Claude Code has been at finding these bugs, noting that while finding such vulnerabilities is traditionally extremely difficult, AI models have made it significantly easier. The most surprising aspect was the minimal oversight required; Carlini used a simple script to prompt Claude to find vulnerabilities in each file of the source tree. One specific bug found was in the NFS driver, where a buffer overflow occurred because the kernel used a 112-byte buffer for a response that could reach 1056 bytes. This bug dated back to 2003, predating the creation of Git. Carlini has identified hundreds of potential bugs, but the manual validation process remains a bottleneck. He predicts a massive wave of security discoveries as researchers and attackers leverage these powerful AI models.