CISO
Dad
Urbanism nerd
My toots only reflect my dog's opinion and are in no way my own or my employer's.
I toot both in English and French.
My toots are automatically deleted after 2 months.
Posts
#Anthropic reports that Claude Opus 4.6 is quite good at finding new vulnerabilities out of the box.
This has been my experience too with our code base at work where scanning it with claude has made it possible to identify several high impact vulnerabilities that had been undetected for years and were more subtle than what a basic SAST tool would see as it combined core vulnerabilities, code logic issues, and specific conditions to reach the vulnerable code.
The questions I still have on this topic is the comprehensiveness of such a system: it's impressive when it finds 0days, but I'm pretty sure that there are still many 0day vulnerabilities that it does not find (false negatives).
Also, it is often quite costly in terms of token consumption, I'm not sure how scalable it is to run such a tool on a frequent basis.