Microsoft Azure CTO says Claude found vulns in Apple II code

"We are entering an era of automated, AI-accelerated vulnerability discovery that will be leveraged by both defenders and attackers."

"When we pointed Opus 4.6 at some of the most well-tested codebases (projects that have had fuzzers running against them for years, accumulating millions of hours of CPU time), Opus 4.6 found high-severity vulnerabilities, some that had gone undetected for decades."

"Billions of legacy microcontrollers exist globally, many likely running fragile or poorly audited firmware like this."

Microsoft Azure CTO Mark Russinovich demonstrated that advanced AI models like Claude Opus 4.6 can reverse engineer decades-old machine code and identify security vulnerabilities. Using his own Apple II utility from 1986 written in 6502 machine language, Russinovich had the AI decompile and analyze the code, which successfully identified multiple security issues including silent incorrect behavior when destination lines were not found. This capability poses significant concerns because billions of legacy microcontrollers globally run poorly audited firmware. Anthropic's Claude Opus 4.6 has already discovered high-severity vulnerabilities in well-tested codebases that remained undetected for decades, indicating both defenders and attackers will leverage AI for automated vulnerability discovery.

Read at Theregister