Evaluating and mitigating the growing risk of LLM-discovered 0-days

Re:Evaluating and mitigating the growing risk of LLM-discove... by lebovic on Friday February 06, 2026 @09:19PM (#46920682)

The post is light on details, and I agree with the sentiment that it reads like marketing. That said, Opus 4.6 is actually a legitimate step up in capability for security research, and the red team at Anthropic – who wrote this post – are sincere in their efforts to demonstrate frontier risks.

Opus 4.6 is a very eager model that doesn't give up easily. Yesterday, Opus 4.6 took the initiative to aggressively fuzz a public API of a frontier lab I was investigating, and it found a real vulnerability after 100+ uninterrupted tool calls. That would have required lots of of prodding with previous models.

If you want to experience this directly, I'd recommend recording network traffic while using a web app, and then pointing Claude Code at the results (in Chrome, this is Dev Tools > Network > Export HAR). It makes for hours of fun, but it's also a bit scary.

[ Parent | on HN ]

Re:Evaluating and mitigating the growing risk of LLM-discove... by Incipient on Saturday February 07, 2026 @08:00AM (#46923508)

This is actually a good concrete example of how to use AI for pen testing (which I've never had time to look at, so I realise it may be common). The issue I'm struggling with is cost - to point O4.6 at network logs, and have it explore...how may tokens/money do you burn?

[ Parent | on HN ]

Re:Evaluating and mitigating the growing risk of LLM-discove... by catlifeonmars on Saturday February 07, 2026 @01:15PM (#46926107)

How much would you pay a pen tester and/or appsec engineer to review your web app? I think it probably evens out.

(I’m not suggesting replacing either with opus, but just trying to put the cost into perspective)

[ Parent | on HN ]