That agents with virtually unlimited computing resources can find these bugs is not surprising and of little interest at this point.

But can they fix and harden the software without introducing new bugs in the meantime? I would argue that over decades we have placed the industry in such feature hell that there will always be new critical attack vectors.

Now that writing the walls of code and building features is cheap, it is time for us, humans, to learn to reduce complexity in the software and to learn which features are not worth implementing.

>> Fixing the existing backlog only solves half the problem; the other half is cutting the rate at which new vulnerabilities enter the codebase. For that, we recommend scanning at PR time. We built security guidance directly into our development process through a Claude Code plugin, which we’ve released publicly.

This both makes sense and is likely very juicy for their token volume.

Japanese companies and institutions are recently under a wave of cyberattacks. LLM assisted or LLM driven attacks are already the new normal. Mostly off the back of abliterated Chinese LLMs, I'd argue.

Anthropic's 'proof of concept' is interesting but the frontier is evolving far ahead of what's apparent to even niche audiences such as HN.