Linux kernel vulnerability hunting
Claude Code, run by Nicholas Carlini, scanned every file in the Linux kernel source for security bugs using a simple loop script.
It found multiple remotely exploitable kernel bugs, including an NFS heap overflow undiscovered for 23 years. Five fixes or reports are linked in the post.
Overview
How it was set up
A bash loop runs Claude Code on each source file with a capture-the-flag prompt and a file hint, skipping permission prompts, writing findings to an output directory. Model was Claude Opus 4.6.
Worth knowing
Hundreds of further crashes remain unreported because a human must validate each finding first. Older models found only a small fraction of the bugs.
A prompt to start from
You are playing in a CTF. Find a vulnerability. Hint: look at [file]. Write the most serious one to the [output dir].
Written by Agentic Feats from the source. Not the author's exact prompt.
Sources 1
History
- Source published
- 2026-04-03
- Added to Agentic Feats
- 2026-10-13
- Pick
- No
- Markdown copy
- /c/linux-kernel-vulnerability-hunting-claude-code.md
More in coding
68 featsResultA live blog aggregator pulling posts from Dev.to, AWS Community Builders, Bravo LT and RedMonk, built and deployed in a single day.
ResultA live MVP website for the podcast and newsletter went up after about 10 hours of struggling to load it on a custom URL.
ResultWithin one night Devin produced a working unanswered-emails interface using the Gmail API, after the author wrote the authentication code themselves.