There are multiple write-ups on how the vulnerability works. The Calif one is the most detailed. Also, no one used Claude. There's a whole world of information out there when you read the original sources instead of social media distortions.
There are multiple write-ups on how the vulnerability works. The Calif one is the most detailed. Also, no one used Claude. There's a whole world of information out there when you read the original sources instead of social media distortions.
> Calif identified a critical flaw using GPT‑5.6 Sol as part of our Patch the Planet initiative, with Wiz also independently discovering and reporting both vulnerabilities
https://openai.com/index/coordinated-disclosure-of-critical-...
> Using Gemini 4 Argon, the team at Wiz has shown why frontier AI is a game-changer for cyber defense. For over a decade, these critical vulnerabilities remained unaddressed because vulnerability discovery and exploitation were incredibly complex.
- Raluca Ada Popa, Head of Gemini Security, Google DeepMind
See? No Claude. Never mind that other man behind the curtain
Neither of those are Claude. Checkmate.
They even did try Claude Mythos earlier in the year, and it didn't find this. There's a reason "no-one used Claude" for this now.
"Earlier this year, we worked with Alpha-Omega to scan PHP with Anthropic's Claude Mythos. But since the Mythos scan, we have added other tools, including OpenAI's Daybreak Red for validating reports and exploits, alongside sanitizer builds and reproduction environments that match our CI on every platform PHP supports."
https://thephp.foundation/blog/2026/10/21/todays-php-securit...
This is the official exploit video in the writeup - https://www.youtube.com/watch?v=pfWZrdzvooc
Haven't you heard? The popular thing to do nowadays is to accuse someone of using AI the second anything is produced whatsoever.
Interestingly enough there are papers that suggest that AI feeding on itself will degrade output quality over time. What I've noticed from my peers is that everything produced now looks the same, and they're sick of it.
Someone had to say it:
DSHR's Blog
I'm David Rosenthal, and this is a place to discuss the work I'm doing in Digital Preservation.
Tuesday, June 30, 2026
Coprophagia Is Bad For You
https://blog.dshr.org/2026/06/coprophagia-is-bad-for-you.htm...
I do tend to disclose my use of AI, but at the same time I don't feel like I'm required to. I'm doing it to signal that my use of AI was productive, and of value to people beyond myself.
but... Calif have said that AI did find this bug.