Project Zero

It’s a commonly followed practice for some people. Notably it’s what was done here: they coordinated disclosure with the Linux kernel devs. And now folks are angry that they didn’t also coordinate with yet more downstream projects. > For reference, the standard is 30 for the developer to fix and 90 for it to land on machines. I’ve never seen that as a standard anywhere. Are you thinking of this? https://projectzero.google/vulnerability-disclosure-policy.html

Plenty of reasons to be skeptical, but also we know that LLMs can find security vulnerabilities since at least 2024: https://projectzero.google/2024/10/from-naptime-to-big-sleep.html Some followup findings reported in point 1 here from 2025: https://blog.google/innovation-and-ai/technology/safety-security/cyber… So what Anthropic are reporting here is not unprecedented. The main thing they are claiming is an improvement in the amount of findings. I don't see a reason to be overly skeptical.

this has been the reality for while now google has been running ClusterFuzz since ~2012, and naptime was announced in 2024 (https://projectzero.google/2024/06/project-naptime.html). they call it big sleep and codemender now. openai announced aardvark last year, no they call it codex security.

How about the infamous iOS hack with a VM implemented in a JBIG2 PDF? https://projectzero.google/2021/12/a-deep-dive-into-nso-zero-click.htm…

The NT Object Namespace itself indeed has no restrictions on filename characters except for "\", but once you reach a real filesystem like NTFS or FAT, the forbidden characters continue to be blocked. https://projectzero.google/2016/02/the-definitive-guide-on-win32-to-nt…

It is getting worse in a measurable way: 1) Since vibe coding GitHub has frequent outages and isn't able to load a large number of comments. 2) The slop translation of Bun resulted in immediate bugs (https://github.com/oven-sh/bun/issues/30719) that the hyped Mythos apparently did not find. 3) AI features and (likely, though not proven) AI code resulted in a 0-day in Google code: https://projectzero.google/2026/01/pixel-0-click-part-1.html The house of cards is beginning to collapse.

If one reads between the lines in part 1, the code in question was introduced due to AI features and the exploit was found by humans: https://projectzero.google/2026/01/pixel-0-click-part-1.html So AI usage increases bugs and humans have to weed them out!

https://secgemini.google/ https://projectzero.google/2024/10/from-naptime-to-big-sleep.html https://deepmind.google/blog/introducing-codemender-an-ai-agent-for-co…

you must be unfamiliar what used to happen before hard deadlines were set on disclosure. it was much worse for the users. here is a good start: https://projectzero.google/vulnerability-disclosure-faq.html#whydeadli… there is ~3 decades of more context if you search for it.

For those interested to read more on AWDL I've listed some interesting articles that I came across during lit review a while back A research lab from TUD worked on a project investigating Apple's wireless ecosystem Link: https://owlink.org/publications/ Also something interesting that I remembered reading closely linked to AWDL? Link: https://projectzero.google/2020/12/an-ios-zero-click-radio-proximity.h…

I mean, it's not uniformly literally technically identical, but yes, an Android phone running its OS in ring 0 while other OSs run in other VMs on top of the EL2 (ring -1) hypervisor under the supervision of the Secure Monitor in L3 (ring -2) is very much in the same boat. Suggested reading: * https://www.maven-silicon.com/blog/privilege-levels-in-arm-architectur… * https://projectzero.google/2017/02/lifting-hyper-visor-bypassing-samsu… * https://en.wikipedia.org/wiki/ARM_architecture_family#Security_extensi… * https://docs.samsungknox.com/admin/fundamentals/whitepaper/samsung-kno… (in which Samsung uses firmware running under the kernel to protect against kernel exploits)

actually you may be right, according to project zero by google [1], ~50% is use after free and only ~20% for out of bounds errors, however, this is for errors that resulted in major exploits, i'm not sure what the overall data is [1] https://projectzero.google/2022/04/the-more-you-know-more-you-know-you…

>> sometimes replaces characters with what it thinks is a more likely character from context Like the JBIG2 algorithm used in a zero click PDF-as-GIF exploit in iMessage a while back: https://projectzero.google/2021/12/a-deep-dive-into-nso-zero-click.htm… The vulnerability of that algorithm to character-swapping caused incorrect invoices, incorrect measurements in blueprints, incorrect metering of medicine, etc. https://www.dkriesel.com/en/blog/2013/0802_xerox-workcentres_are_switc…

It looks like atril is mostly written in C: https://github.com/mate-desktop/atril A crafted PDF can potentially exploit a bug in atril to compromise the recipient's computer since writing memory-safe C is difficult. This approach was famously used by a malware vendor to exploit iMessage through a compressed image format that's part of the PDF standard: https://projectzero.google/2021/12/a-deep-dive-into-nso-zero-click.htm…

Maybe https://projectzero.google/archive.html https://netflixtechblog.medium.com/ https://www.uber.com/en-US/blog/engineering/

Blog post: https://projectzero.google/2025/12/welcome.html (https://news.ycombinator.com/item?id=46295984)

take a look at this bug and the chain required to exploit it: https://projectzero.google/2021/12/a-deep-dive-into-nso-zero-click.htm… https://projectzero.google/2022/03/forcedentry-sandbox-escape.html exploiting vulnerabilities on hardened targets isn't just in a different league from finding them, it is a different sport altogether. put simply, it's the difference between an integer overflow leading to a sandbox escaping RCE and one that leads to a crash. Codex Security and 5.5/5.6 are still very good finding vulnerable code -- they will identify and fix unsafe behavior, but they will refuse to help you with exploitation -- they will actively prevent you from taking any steps to weaponize the unsafe behavior that are not required to remediate it. they will err conservative here, but for the most part they will still let you discover and address a wide range and depth of vulnerabilities. you can verify yourself to turn off the most basic safeguards and sign up through a more rigorous process for a spectrum of TAC options. obviously there is a balance here -- openai wants to empower defenders while at the same time not exposing capabilities to the adversaries that would overwhelm defenders. there is no "right" answer. it is a work in progress. this is an intentional and deliberate decision to provide defenders with a (temporary, dwindling) advantage. the example i chose was pretty extreme, but the underlying principle -- enable visibility discovery and remediation, but…

The problem is that a patch to fix a security issue quite often also shines a spotlight on the issue being fixed. Fixing a part of something like this super complicated Project Zero post might not give much of a clue as to what the issue was or how to exploit it: https://projectzero.google/2021/12/a-deep-dive-into-nso-zero-click.htm… But that's the exception. Most fixes to security issues point a finger directly at the issue, make it relatively obvious how to exploit, and generally doesn't take long to figure out from there what you might get out of it. This has been a problem for a long time but AIs have made it even worse. It is now cost effective for a well-resourced attacker to simply monitor the patch stream of an important project like the Linux kernel or nginx and pass every single one through an AI with the question "Is this a vulnerability and if so how would I exploit it?" It has seriously complicated the process of getting fixes to people before the attackers have a chance to exploit it, just as AIs have also been increasing the rate at which serious security issues that have been found also need to be patched. Previously they could at least sneak a patch in under an innocuous commit message and have a reasonable chance of being lost in the churn, but now that door is increasingly closed to them as well. And this is for the case when a security fix lands in the stream of a project and someone externally is watching it with no context. If you also get the…

> Separation from the hypervisor kernel? Not really. Separation from (type 1) hypervisor (or rather distrust of the host [0]) requires hardware support; ex: ARM CCA / AMD SEV-SNP / Intel TDX. For separation from the supervisor, Android developed a peculiar approach in "pKVM" for ARM where the host (supervisor) is partitioned away from the guest [1]. Both those "separations" is not something Toro provides on its own; the Toro unikernel would totally be under the control of the host, from what I can tell. That said, what Toro (or any unikernel, really) does is reduce the attack surface area, as the (guest) supervisor is pruned to run just one particular application (more code to partition things up will eliminate a class of attacks but may result in new attack vectors [2]). [0] ex: https://news.ycombinator.com/item?id=44678249 [1] Protected KVM on Arm64: A Technical Deep Dive - Quentin Perret, Google https://www.youtube.com/watch?v=9npebeVFbFw (2023) [2] Mitigations are attack surface, too https://projectzero.google/2020/02/mitigations-are-attack-surface-too.… (2020)

To play a bit of devil's advocate, I don't think the problem is necessarily with the compiler output. It's more that it's not always easy to definitively state the precise consequences of a particular issue, especially when it comes to memory safety-/UB-related issues. For example, consider this Project Zero writeup about using a single NUL byte buffer overflow as part of a root privilege exploit [0] despite some skepticism about whether that overflow was actually exploitable. To be fair, I'm not saying that Greg KH is definitely wrong; I'm only willing to claim that in the general case observing crashes due to corrupted pointers does not necessarily mean that there's no ability to actually exploit said corruption. Actual exploitability will depend on other factors as well, and I'm far from knowledgeable enough to say anything on the matter. [0]: https://projectzero.google/2014/08/the-poisoned-nul-byte-2014-edition.…

All references here, do your own research: References [1] SecurityWeek, "Hackers Weaponize Claude Code in Mexican Government Cyberattack," Feb. 2026. [Online]. Available: https://www.securityweek.com/hackers-weaponize-claude-code-in-mexican-… [2] Anthropic, "Threat Intelligence Report: August 2025," Anthropic, Aug. 27, 2025. [Online]. Available: https://www-cdn.anthropic.com/b2a76c6f6992465c09a6f2fce282f6c0cea8c200… [3] D. Stenberg, "Mythos finds a curl vulnerability," daniel.haxx.se, May 11, 2026. [Online]. Available: https://daniel.haxx.se/blog/2026/05/11/mythos-finds-a-curl-vulnerabili… [4] Trail of Bits and OpenZeppelin, "Arbitrum Research and Development Collective (ARDC) procurement-grade pricing benchmarks," 2024. Approximately $25,000 per engineer-week for senior smart-contract auditing. [5] W. Xiao, C. Killian, H. Sleight, A. Chan, N. Carlini, and A. Peng, "AI agents find $4.6M in blockchain smart contract exploits," Anthropic Red Team / MATS / Anthropic Fellows program, Dec. 1, 2025. [Online]. Available: https://red.anthropic.com/2025/smart-contracts/ [6] P. Paganini, "Claude code abused to steal 150GB in cyberattack on Mexican agencies," SecurityAffairs, Feb. 2026. [Online]. Available: https://securityaffairs.com/188696/ai/claude-code-abused-to-steal-150g… [7] Immunefi, "2026 State of Onchain Security," Immunefi, Jan. 2026. 425 publicly disclosed exploits 2021-2025 totaling $11.9 billion;…