OK so claude code is good, but dont quit your day job, it missed 3 pre-auth RCE but did find the file read chain. Not to bad.

Mar 10, 2026 · 6:29 AM UTC

5
5
124
12,874
I’ll use some more targeted context today, it did pick up on a complex ssti that I missed via a spring endpoint
5
854
Sort replies: Relevant Recent Liked
Replying to @steventseeley
When you say it missed 3 pre-auth bugs, have you run it with tailored prompts ? Long running session? Or was it a single shot over some logic?
1
3
567
Yes to the first 2 questions
2
371
Replying to @steventseeley
it finds a lot of RCE, you just need to tune your prompt well and give it strong context. also try codex for real vuln research work its much better than claude code
2
305
Replying to @steventseeley
Try GPT 5.4 in Codex for cybersecurity stuff, it's much better
1
1
466
Replying to @steventseeley
You have to run it like 5 times
257