A researcher used Claude Opus in Claude Code with Playwright MCP to decompile code, find vulnerabilities, and build a working exploit.
A researcher used Claude Opus in Claude Code with Playwright MCP to decompile code, find vulnerabilities, and build a working exploit.
Kev Breen gave Claude Opus in Claude Code (with Ghidra/ilspy, semgrep, Playwright and Proxmox tools, root on an isolated code-server harness) a single prompt to investigate a newly reported PaperCut NG zero-day, build a lab VM, and patch-diff the vendor fix. The agent autonomously decompiled jars, traced IoCs, found an auth-bypass and SQLi, used Playwright to drive the admin UI, and iteratively built and self-tested PoC scripts, with the human mainly steering direction and challenging weak conclusions.
Within 90 minutes it produced a working unauthenticated RCE chain (auth bypass, SQLi, arbitrary file write, code execution), later finding a third bypass that defeated the emergency patch too; total run used 10 prompts, 293 tool calls, 224M tokens over about two hours, though it initially hit a dead-end chain and made a false 'validated' claim the researcher had to catch.
Hit an Opus 5 safety guardrail when checking exploitation logs, forcing a fallback to Opus 4.8 mid-session.
Given this [software patch or diff], analyze what changed, decompile or inspect the relevant binaries, and identify the security vulnerability it fixes. Build a proof-of-concept exploit demonstrating the issue in a safe, isolated test environment, and stop before using it against anything outside that environment.
Plan, execute and review a cross-cutting refactor in small batches, with Claude Code making the edits and GitHub Copilot reviewing each PR.
Claude Code reads your coverage report, picks the riskiest untested modules and writes unit tests that pass, one small PR at a time.
A Claude Code-built agent checked ESPN every 30 minutes and sent each 2026 World Cup final score, written up in a persona, to a 3-person Signal group, with a code check on scores.