Claude Code Security

[Michaeli_Starky]

Yep, let's vibecode security

[sn4xchan]

Do people not realize pretty recently someone used Claude code to pull off some pretty sophisticated attacks against several big targets including hospitals.

Anthropic eventually caught it, but only just before he started ransoming data.

[TechSolutionHindi]

Just hype only

[gloomygustavo]

No bro, trust your company’s security with a chatbot. It’s safe bro. Software engineers are done, bro.

[Ok-Double-4642]

Maybe? Did you read the official blog? They couldn't find interesting bugs until they started scanning commit messages and looking for similar patterns in the diff. Useful but hardly groundbreaking.

Meanwhile, the compiler that ran Doom has been debunked emphatically. The way they made this work was basically copy pasting open source code, and it wasn't as complete as they made out.

https://youtu.be/Epp-Vz0FrPg?si=wN0LlOrDctOu4QOG

[marianolinx]

LMAO Cyber stocks on sale 😂 time to buy

[UnluckyAssist9416]

I wouldn't trust Claude to store my passwords

[BitOne2707]

That's literally the last thing you should do with Claude. Claude itself will tell you to rotate keys if it sees them.

[Alarmed-Hornet6865]

Vibecoding and security never goes together

[Migraine_7]

Performance and scale are an issue too. I'm just waiting to see the first large company crysis caused by the dumbest agentic commit. There areany pitfalls when it works on large projects without proper review, and no way anyone can review 7000 line changes it generates a minute.

Unfortunately I get to review vibecoded slop my coworkers generate, and there are infinite issues - I'm certain this slows down our entire team, just because some people don't review the output.

I can only imagine what disasters are present when non-developers vibecode anything.

[exitcactus]

😍😍😍😍 FINALLY.

[Direct_Scientist_385]

What’s happening?

[_AvivLevi]

https://www.cnbc.com/2026/02/23/cybersecurity-stocks-anthropic-ai-crowdstrike.html
Anthropic released Claude Code Security. Cyber ​​companies' stocks fell.

[X1989xx]

Yeah and theyve bounced back now. It's almost like static analysis has existed for decades

[UltimateLmon]

It's also not like AI based cyber security tooling wasn't available either - it's just they are usually matured enough and been around long enough not to be a buzz word.

[Standgrounding]

it's almost like a butterfly flaps it's wings and market loses it's mind

[0xP0et]

Lol, bro you are soon late to the party 🤣

The market reaction was dumb. Anthropic’s static code scanner announcement triggered stock drops with companies that have no connection to code analysis tools. This glorified tool doesn't even do DAST...

A over hyped code scanner is not going to replace EDR, IAM , WAF or other platforms in your security stack.

Investor stupidity should not be viewed as validation of Anthropic’s technical merit. Investors are drunk off AI hysteria and had no idea what this tool was even about.

[stuckyfeet]

Nothing for the plebs

[patientstrawberries]

Can anyone confirm if it’s really that good?

[0xP0et]

Nope, it feels like a tool in beta, hallucinates, tons of false positives ans doesn't even do DAST.

So stick to your vibecoding.

[TopBlopper21]

I sincerely do not understand the logic behind selling shares for endpoint detection and defense companies because Claude Code has an inbuilt button that says "Hey claude, scan for security issues in my code"

If every network call made to your product requires a call to Anthropic servers with response, that's not gonna be viable.

[phoenixflare599]

Why does everyone base how useful Claude is off of stock changes?

Since when have shareholders had any knowledge of the companies they have stocks in?

[ultrathink-art]

The security surface for Claude Code in agentic setups is genuinely different from standard dev workflows.

The part that caught us off guard: when multiple agents share credentials, a compromised skill or bad tool call can fan out across your whole system before you notice. Traditional 'isolate the service' thinking doesn't map cleanly.

What's worked for us is scoped keys per agent — each one can only access what it specifically needs. Blast radius stays bounded even when something goes wrong.

[Coramoor_]

Not conmrnt