I Found a $90k Remote Code Execution Vulnerability in Google

EdwardDiego

Bold choice using the noun "I" repeatedly instead of "Claude" - you didn't figure this out, Claude did, and then Claude very obviously wrote the blog post. Oh, maybe that's why "Claude" was substituted with "I", because Claude wrote this blog post from a first person perspective.

stonyrubbish

Do you have any advice for aspiring bug-bounty hunters? Do you have some method for being able to find vulnerabilities like this, or lots of past experience?

consumer451

Sorry for the meta, but the discourse in many of the comments is nuts to me. "Claude did this, not you" - does that mean that humans have no agency at all when they use an LLM? Is that the argument? Maybe the norm should be to credit the LLM and harness used, like "I used ___ to help me find an RCE", but I can see arguments not to do that in some cases. edit: The giant thread with this now got flagged, so some users may not see it.

iJohnDoe

If this were Microsoft, they would have received a coupon for 10% off a Thanksgiving turkey, only redeemable in 2030 and only in the month of March, must be purchased with cash, non-transferrable.

option_greek

how does something like this pass code and design reviews. is this code written by ai (the buggy code). Not only was the key that signs the cookie inside the cookie it self but it's using pickle which even model weights are moved away from. I'm a little flabbergasted at the noob nature of this root cause.

dualvariable

> "Four things had to change, and they stack:" When you write your blog post with claude, I start hitting these phrases and then start only skimming and looking for them, and stop reading what you have to write.

nerder92

Nice catch, but god terrible write-up. Please take the time to write it yourself even if you think you will do worse in explaining it than the LLM. It’s so off-putting to read that. Share your prompt or raw article notes even, it will much enjoyable to read than this

Quitschquat

> code execution across seven Google domains What a bargain

shoebilyas_hanz

That's an engineer right there. I really love how you didn't just 'it is what it is'. Claude is never replacing engineers like you.