Anthropic is trying to sell us a new kind of intelligence, but this is really just a very expensive linter. The research into discovering cryptographic weaknesses looks impressive on a slide deck, but it fundamentally relies on the fact that most crypto bugs are repeats. If you have seen ten thousand versions of a botched RSA implementation, you do not need “reasoning” to spot the eleventh; you just need a massive lookup table and a bit of fuzzy matching. It is the difference between understanding the laws of physics and simply having memorized every accident that ever happened on a specific stretch of highway.
The short answer is probably not in the way we want. It is great at spotting the “oops, I forgot to seed the RNG” type of errors because those patterns are littered across every GitHub repo and Stack Overflow thread from the last two decades. It is like a music critic who can tell you a song is a rip-off of a 70s disco hit because they have heard every record ever pressed, but they couldn’t actually write a symphony from scratch.
Finding a true zero-day in a modern, well-audited library requires a level of mathematical intuition and first-principles logic that LLMs still lack. They are probabilistic engines, not formal verification tools. They can guess that a certain line of C looks “wrong” based on similarity to other bugs, but they cannot prove a vulnerability exists through a rigorous mathematical chain of custody. (And they probably cost a fortune in tokens to run for a full codebase). Or maybe they can—but the evidence suggests they are just very good at spotting “smelly” code.
Not by a long shot. If anything, these tools just move the bottleneck. We are shifting from “finding the bug” to “filtering the noise.” An LLM will happily flag fifty “potential” weaknesses, forty-nine of which are hallucinations or irrelevant to the specific implementation context. You still need a human who actually understands the math to sift through the garbage.
The friction here is obvious: the latency of waiting for a massive context window to process and the subsequent manual verification of every single claim. If a senior security engineer spends four hours debunking forty-nine false positives to find one real bug, did the AI actually save them any time? Probably not. It just changed the nature of the boredom. Who actually wants to be the first person to trust a probabilistic model with their root keys?
Security is an arms race, and Anthropic just handed a powerful microscope to both the guards and the thieves. The asymmetry of security is the problem here. A defender has to plug every single hole; an attacker only needs to find one. By automating the “low-hanging fruit” phase of vulnerability research, these models significantly lower the barrier to entry for script kiddies.
The real danger is the complacency it creates. There is a risk that developers will stop doing the hard work of rigorous design because they think the “AI auditor” will catch their mistakes. That is a recipe for disaster. It is the digital equivalent of trusting a spell-checker to write your legal contract. By Q4, we will see a dedicated security fine-tune for Claude that explicitly targets these patterns, and the floodgates of automated vulnerability scanning will open wide.
The gap between “spotting a pattern” and “doing math” is wider than these papers admit. If you want to find a flaw in a new elliptic curve implementation, you don’t look for “smelly code”—you look for a mathematical property that hasn’t been accounted for. LLMs don’t do that. They don’t simulate the math in a sandbox; they predict the next token based on how other people have talked about math.
We have seen this before with the “reasoning” claims in various model releases, where a bit of Chain-of-Thought prompting is rebranded as a cognitive leap. It isn’t. It’s just a longer path to the same probabilistic guess. Until these models are integrated with formal verification languages like Coq or Lean, they are just fancy pattern matchers.
A helpful tool, but not a replacement for a brain.
