---
title: "Reverse engineering a papercut zero-day"
canonical: "https://agenticfeats.com/c/reverse-engineering-a-papercut-zero-day-claude-code/"
agents: ["Claude Code"]
evidence_grade: "A"
outcome: "partial"
job_type: "Coding"
roles: ["Developer"]
source_url: "https://techanarchy.net/from-patch-to-exploit-using-claude-code-to-reverse-engineer-a-zero-day-in-papercut-ng"
evidence_url: "http://172.21.2.65:8000/-home-coder-projects-iot-research-claude/projects/papercut-ng/scripts/poc_c1_auth_bypass.sh?ref=techanarchy.net"
source_date: "2026-08-30"
published: "2026-10-13"
updated: "2026-10-13"
---

> From Agentic Feats: sourced examples of AI agents at work. Map of the site for agents: https://agenticfeats.com/llms.txt

# Reverse engineering a papercut zero-day

Claude Code analyzed a patch for an actively exploited Papercut NG vulnerability and worked to build a working exploit chain.

Result: Within 90 minutes Claude produced a functional proof of concept confirming an authentication bypass across four tested endpoints.

## How it was set up

Claude Code with Opus running in a code-server harness with custom skills for binary analysis, reporting, Proxmox lab deployment, Ghidra, semgrep, and Playwright MCP for installing the target app.

## Worth knowing

A safety guardrail briefly blocked log analysis and swapped the model; the author notes the full exploit chain claim was not entirely accurate.

## Prompt

```text
A new vulnerability was reported for [software]. Investigate whether a patch exists, build a lab for the vulnerable version, and diff the patch against available reports and indicators of compromise to find the root cause.
```

## Evidence note

Author's detailed session log with screenshots and a linked PoC script

## Sources

- Original: https://techanarchy.net/from-patch-to-exploit-using-claude-code-to-reverse-engineer-a-zero-day-in-papercut-ng
- Evidence: http://172.21.2.65:8000/-home-coder-projects-iot-research-claude/projects/papercut-ng/scripts/poc_c1_auth_bypass.sh?ref=techanarchy.net

## The receipt

- Agent: Claude Code
- Evidence: Shown (grade A, artifact linked)
- Outcome: Partial
- Job type: Coding
- Roles: Developer
- Source: Blog
- Published: 2026-08-30
- Added: 2026-10-13