Calif, a security firm, publishes vulnerability research, exploit write-ups, and reverse engineering, including AI-assisted bug finding.
HN commenters link it for the write-up of Claude writing a FreeBSD kernel exploit, including prompts, and for its macOS kernel exploit work.
Worth noting that at this point, it's still somewhat trivial to find exploitable remote code execution bugs in Ladybird using AI tools.[0]
The userbase of Ladybug users is so small that it's probably not worth the attackers' time, but keep in mind that it's an enormous step down in security from the mainstream browsers who are actively searching for bugs using the latest tools and paying bug bounties on external reports.
[0] https://blog.calif.io/p/mad-bugs-rce-in-ladybird
Calif.io have access to Mythos Preview which they've used to find a macOS kernel memory corruption exploit on Apple M5: https://blog.calif.io/p/first-public-kernel-memory-corruption
It's probably the right approach to onboard a few independent security companies and task them with reviewing multiple OSS projects than it is to onboard each project individually.
Oh hey, this is our work! We helped Anthropic analyze and report this bug.
For the record, this bug has nothing to do with our recent MIE attack [1] [2], which exploited two different kernel bugs. Our bugs are not fixed yet.
[1] https://blog.calif.io/p/first-public-kernel-memory-corruption
[2] https://news.ycombinator.com/item?id=48139219
Calif (Thai Duong's firm) did a writeup on this, which should probably be the link here; it includes the prompts they used:
https://blog.calif.io/p/mad-bugs-claude-wrote-a-full-freebsd
A reminder: this bug was also found by Claude (specifically, by Nicholas Carlini at Anthropic).
Or even better, the blog post.
https://blog.calif.io/p/mad-bugs-claude-wrote-a-full-freebsd
But I found the exploit writeup pretty interesting
Claimed to have been discovered with/by Claude: https://blog.calif.io/p/mad-bugs-vim-vs-emacs-vs-claude