Cryptography engineer Filippo Valsorda's write-up on Claude Code debugging low-level crypto.
Cryptography engineer Filippo Valsorda's write-up on Claude Code debugging low-level crypto.
Filippo Valsorda ran Claude Code (Opus 4.1, no system prompt) on his new Go ML-DSA implementation. His prompt named the test command and code directory, described the failing symptom, and asked it to think hard. It read the code and traced the bug. It also tested a hypothesis with a small test of its own. He then repeated this on two earlier signing bugs, using a fresh session for each.
It found all three bugs in one shot without help. The Verify bug took minutes: high bits were taken twice. Its proposed fixes were mediocre, so Valsorda threw them away and rewrote them himself.
Use well-scoped failing tests, start a fresh session for each independent bug, and treat the agent's output as a pointer to the bug, not a fix to merge.
I have a failing test in my cryptography code at [path], where [describe the symptom, e.g. wrong output for certain inputs]. Investigate why it fails, compare against [reference implementation or test vectors], and propose a fix. Finished means the tests pass and you've explained the root cause, and you should show me the diff before changing any files.
Plan, execute and review a cross-cutting refactor in small batches, with Claude Code making the edits and GitHub Copilot reviewing each PR.
Claude Code reads your coverage report, picks the riskiest untested modules and writes unit tests that pass, one small PR at a time.
A Claude Code-built agent checked ESPN every 30 minutes and sent each 2026 World Cup final score, written up in a persona, to a 3-person Signal group, with a code check on scores.