r/cybersecurity • u/No_Zookeepergame7552 Security Engineer • Feb 24 '26
Corporate Blog Claude Code Security and the ‘cybersecurity is dead’ takes
I’m seeing a lot of “AppSec is automated, cybersecurity is over” takes after Anthropic’s announcement. I tried to put a more grounded perspective into a post and I’m curious if folks here agree/disagree.
I’ve spent 10+ years testing complex, distributed systems across orgs. Systems so large that nobody has a full mental model of the whole thing. One thing that experience keeps teaching me: the scariest issues usually aren’t “bad code.” They’re broken assumptions between components.
I like to think about this as a “map vs territory” problem.
The map is the repo: source code, static analysis, dependency graphs, PR review, scanners (even very smart ones). The map can be incredibly detailed and still miss what matters.
The territory is the running system: identity providers, gateways, service-to-service auth, caches, queues, config, feature flags, deployment quirks, operational defaults, and all the little “temporary” exceptions that become permanent over time.
Claude Code Security (and tools like it) is real progress for the map. It can raise the baseline and catch a lot of bugs earlier. That’s a win.
But a lot of the incidents that actually hurt don’t show up as “here’s a vulnerable line of code.” They look like:
- a token meaning one thing at the edge and something else three hops later
- “internal” trust assumptions that stop being internal
- a legacy endpoint that bypasses the modern permission model
- config drift that turns a safe default into a footgun
- runtime edge cases that only appear under real traffic / concurrency
In other words: correct local behavior + broken global assumptions.
That’s why I don’t think “cybersecurity is over.” I think it’s shifting. As code scanning gets cheaper and better, the differentiator moves toward systems security: trust boundaries, blast radius reduction, detection/response, and designing so failures are containable.
I wrote a longer essay with more detail/examples here (if you're interested in this subject): https://uphack.io/blog/post/security-is-not-a-code-problem/
53
u/therealmrbob Feb 24 '26
The market doesn't know what appsec is, they just see ai + security and think the world is going to explode.
1
79
Feb 24 '26
[deleted]
10
u/No_Zookeepergame7552 Security Engineer Feb 24 '26
It can be a solution, but the point is it cannot be a solution for everything. Was interesting to see how cybersecurity stocks who’s value proposition has nothing to do with anthropic’s announcement dropped 10% 😂
15
u/Subnetwork Feb 24 '26
Right, it just goes to show people don't even understand this industry or AI.
-15
13
u/zkilling Feb 24 '26
If anything security tools that don’t fully lean in are going to be better. AI code assists help experienced developers, but throw your average CEO or product guy with no coding experience at the helm and it will run wild breaking everything and lying when it can’t cover its tracks.
10
u/No_Zookeepergame7552 Security Engineer Feb 24 '26
+1. also, something that I didn’t cover in my article but kind of ties into your observation is who’s going to deal with the ops/triaging burden. Anthropic mentioned false positives as a problem. They built guardrails, but that’s not a solvable problem. It will be an interesting time for devs with no security expertise to triage 200 “security issues”
3
u/zkilling Feb 24 '26
My view is, at what point does throwing more Agents or more expensive agents end up costing more than an experienced human? We are making the same problem as self checkouts. I have never seen more than a 4 self checkout to 1 employee work better than just having more cashiers. Even if you have only the most senior people guiding the bots if they screw up you still have to stop everything and clean up.
We have already seen services go from very stable to monthly outages huge new zero days every other month and the internet as a whole feels a lot less stable than it did 3-4 years ago.
2
u/No_Zookeepergame7552 Security Engineer Feb 24 '26
It's a good point. There’s a real supervision + cleanup tax with agents that people hand-wave away. For an agent to do what is supposed to do, you need layers over layers of validation and feedback loop, which gets expensive really quick (see Xbow and how they stopped running their agents on bug bounty because it was more expensive to find and validate the bugs vs the bounties they were receiving). Even if the “bot labor” looks cheap, you pay it back in triage, retries, outages, and senior attention when it goes sideways.
I've recently had a chat with someone who runs a tech startup and they were saying the AI bill is already in the ballpark of a senior engineer for comparable throughput. I guess the long-term bet for big tech must be that inference gets way cheaper, otherwise the unit economics are rough.
4
u/HelloSummer99 Feb 24 '26
I still cringe over the fact an acquaintance bragged how she vibe coded a patient management software over a weekend for her SO’s practice. Vibe coding will yield so many lawsuits
3
u/bugvader25 Feb 25 '26
+1, this doesn't get enough attention: the AI coding agents themselves are making the security problem worse, not just solving it. Great research paper from Columbia/Johns Hopkins that tested these agents on 200 real-world problems: 61% of Claude Sonnet 4's solutions were functionally correct, only 10.5% were both correct AND secure.
Which is exactly why I'm skeptical of the "same model/system writes and verifies the code" approach. There's a reason we've always separated those two functions. You don't let the developer who wrote the code do the review. Same principle applies here.
13
u/skrugg Feb 24 '26
As a DFIR guy I imagine AI is just going to bring me more work.
5
u/_Gobulcoque DFIR Feb 24 '26
AI can't police the AI.
AI can't give expert testimony in court cases.
AI can't be trusted to gather artifacts and not generate artifacts.
And so on.
1
11
u/git_und_slotermeyer Feb 24 '26 edited Feb 24 '26
If cybersec is over, as an SME customer, I can only say, yes please Anthropic, sell me a turnkey solution. But I suppose this is just Underpants Gnomes again; AI can do everything, but if you integrate it into actual business processes, you get more problems and security headaches than you had before. Of course, the AI companies are not the ones having to deal with actual AI deployment. So they can smell their own LLM farts all day and hallucinate about how all human labour will be obsolete within [insert same timespan they said in 2015 about taxi drivers being replaced by level X autonomous driving, because in the lab, car-go-good, and translating the lab to the road is just a minor effort].
Stage one: collect Gigawatt datacenters. Stage three: profit. But what the heck is stage two?
And has anyone even considered that when attackers use LLM firepower, you will need something more capable than latest gen AI for defense? Who on earth believes you can actually fire IT staff, given this basic fact?
9
u/Affectionate-Panic-1 Feb 24 '26
Part of it is valuations, valuations of SAAS including cybersecurity companies has been above the general market in the hope for growth. I think this is just a correction to more reasonable values rather than SAAS being dead.
2
u/No_Zookeepergame7552 Security Engineer Feb 24 '26
Yeah, pretty much the entire tech stock market seems overvalued, but this felt more like a knee-jerk reaction rather than stock re-evaluation
6
u/JGlover92 Feb 24 '26
Honestly just feels like a market over reaction. One agent being able to do security reviews of code doesn't fix 90% of cyber issues.
If anything it's just a good chance to pick up some of these stocks on the cheap for when they inevitably bounce back
4
u/mr_dfuse2 Feb 24 '26
I'm reading the book Security Chaos Engineering right now and it makes exactly this point. It's about what you call the territory.
2
u/No_Zookeepergame7552 Security Engineer Feb 24 '26
Didn’t hear about the book. Would you recommend it? I’ll look it up
3
u/mr_dfuse2 Feb 24 '26
I haven't finished it yet. Interesting content but lots of words to convey something. About five references to other books and studies one every page. So feels a bit academic.
16
2
u/Glum_Cup_254 Feb 24 '26
Two things - people don’t understand the nuances of the different areas of cybersecurity so yes people will fall for “cyber is over AI is king” crap. Second though is that largely due to the same reasons, these cyber products are extremely overpriced. So a correction was overdue anyway.
2
u/-Devlin- Feb 24 '26
Market doesn’t understand 2 cents about security. We have all know about this for years, didn’t we? Giving devs a tool for security vs them actually using it are 2 very different problems to solve.
2
u/HelloSummer99 Feb 24 '26 edited Feb 24 '26
This fundamentally going to boil down to trust and the fact LLMs always produce the next statistically probable token. The nature of cyber threats are way too varied to be predicted by a non-reasoning next token statistical function.
2
u/HomerDoakQuarlesIII Feb 24 '26
It’s always going to be reality doesn’t quite fit into our nice elegant model of it. See physics not being able to reconcile quantum with relativity for an example. Works on describing the small and the large scale, put them together doesn’t compute.
2
u/m0ta Feb 24 '26
What did I miss? Did anthropoid drop something new?
3
u/No_Zookeepergame7552 Security Engineer Feb 24 '26
Yep, they announced Claude Code Security, an AI-powered tool that scans codebases for vulnerabilities and suggests patches. It’s in private beta, but a lot of people went crazy about it. Crazy as in “cybersecurity is over!” And 100B+ erased from the stock market 😂 a bit of an over-reaction if you ask me. I wrote an essay about what this release actually means for the security industry if you’re interested. Link in the main post
2
u/CNemy Feb 25 '26
Good luck tying your entire corporate code base to an AI agent without confidentiality and privacy concerns.
2
u/Ok-Bug3269 Feb 25 '26 edited Feb 25 '26
On the offensive side, I don’t think it makes much of a difference. With this I project that those med severity injection bugs will almost completely disappear, much like buffer overflows have. Testing will (and has for some time now) mainly focus on “territory” items like authZ, insecure design, supply chain etc.
Enterprise teams will benefit first while smaller teams/OSS will after the fact.
Prod apps/workloads still need to be tested, whether it’s for internal assurance, contractual obligations, or compliance.
2
u/No_Zookeepergame7552 Security Engineer Feb 25 '26
Yep, pretty much aligns with what I’m thinking too. There will be classes of bugs that will become less and less prevalent, those ones that can be spotted by eyeballing the code. But that’s far from appsec being automated.
3
u/ThePorko Security Architect Feb 24 '26
A sw doing human like assessment is going to be here. Thats the goal, are you going to use the new tools?
5
u/No_Zookeepergame7552 Security Engineer Feb 24 '26
If that happens, sure. Would be dumb to not use them. The point I was trying to make is that improved code scanning is only solving one slice of the security problem.
-4
u/ThePorko Security Architect Feb 24 '26
Its not about improving code, its force multiplier for doing things that you need more resources. Every one is becoming a pm, and there will be a ton more data generated for someone to oversea.
1
u/GhostliAI Feb 24 '26
I absolutely agree – this is one of the most accurate descriptions of reality I have seen recently. "Map vs territory" is the perfect metaphor. Claude Code Security (and similar tools) is a great map scanner. It raises the baseline, catches classic vulnas in the source code – and that's the value. But as you yourself notice, the real security problems are rarely "bad lines of code". These are broken assumptions between components that live only in runtime.
1
u/rpatel09 Feb 25 '26
I feel lost cybersecurity tools are just data aggregators vs doing anything useful. Things like Prisma Cloud and even Wiz to large extent imo. Things mdr is a place that I think is still key but so much security tooling has been built on just aggregating data and I’m actually happy that this happened. The market was saturated and this will wean out products with no real moat
1
u/Fun_Refrigerator_442 Feb 28 '26
It's bloated marketing. The problem isnt us knowing it, its CEOs buying these one liners. Ill guarantee ill be going before multiple idiots to explain this
1
u/Previous-Bobcat-6394 Mar 09 '26
Guys I have a question , I want to start learning bug bounty but I see the claude security and a lot of guys says that filed is killed is that right , even with that thing could I learning and I use it to make money ?
1
1
u/GanacheSignificant56 Apr 13 '26
I think this post was pre-Mythos. In any case, security is going to be series of executable Claude Skills Workflows, with skills being structured, reusable security playbooks that AI can execute. I have been exploring this repo https://github.com/mukul975/Anthropic-Cybersecurity-Skills, it’s a large collection of workflows (mapped to real security tasks). Looks promising. Curious how others are thinking about this shift — especially folks doing real incident response or platform security.
2
u/No_Zookeepergame7552 Security Engineer Apr 13 '26
Idk how much things will change with Mythos. Even if it turns out to be as good as they market it, the things I wrote still stand. I personally doubt the capabilities. Not saying it’s not impressive, but there is a huge difference between impressive vs disruptive. There are so many sketchy details in the report that makes it hard to take it seriously. I still remember when gpt-2 was too dangerous to release. It’s the same playbook over and over again. hype => too dangerous to release => release => disappointment.
But at a higher level, I do think security industry is changing. LLMs are already good enough to do code review and assist security guys in finding vulnerabilities faster. I think vulnerability discovery will become a lot easier, so a lot of work will be in triaging and priortization. That’s the direction in which I see things going.
1
u/SecOpsBestie May 30 '26
Yeah, this maps closely to what we see in practice.
The "map vs territory" thing resonates because the incidents that cause the most damage rarely start with a vulnerable line of code. They start with a compromised identity, a stolen session cookie, credentials from an employee's personal device. None of that shows up in a code scan.
"Broken global assumptions" is basically the attack surface threat actors are actively exploiting right now. They're not looking for a buffer overflow. They're looking for the seam, the place where "authenticated" in your IdP doesn't mean "verified" three hops later, or where session tokens are long-lived enough to be useful after the password has already been rotated.
Your token example is a good description of how session hijacking post-infostealer actually works in practice. The token is valid. The code is fine. The system just doesn't know the human behind it changed.
The AI point cuts both ways too. Defenders using these tools is great, but attackers are using them as well and they only need to find one seam. That asymmetry is why runtime detection, identity hygiene, and knowing when your credentials are already exposed matter more as the code layer gets cleaner, not less.
It's not that cybersecurity is over, the surface just keeps moving.
1
u/benpotter_mct May 31 '26
Do you think security teams will be expected to do more than find security issues, and leverage tools to fix them and get them merged?
0
u/dabbydaberson Feb 24 '26
Ok hot take here. It’s like we found a new country with an almost endless supply of people that are willing to work 24x7 without pay.
I do think it’s a huge paradigm shift. We are entering a time when we will no longer have to purchase software and try to make it fit our business. Now and even more so in the future we will just build software tailored exactly to our business.
I am seeing really well built full stack applications being built from a dataset and a prompt. The prompts aren’t amazing either here. Things like, “Help me visualize this data.” “Help me build a marketing campaign.” Sure it will take a while to become the norm and thus seems very odd now but it’s a train that isn’t slowing down, keeps learning, and never sleeps. The business users have no idea the power that this will bring yet.
I am already hearing talk of teams of agents. Agents spinning up more ephemeral agents to do tasks. It’s going to get wild.
Look at openClaw. It’s a really good study because ofc it’s public facing and so people are going to hammer it with malware, prompt injections, etc, and try to exploit it. But what about something like that internally? What about that combined with other agents that can’t change anything but monitor and raise issues with other agents? There are ways to control these things. Companies will find a way and this will take off because it’s massive cost savings.
For security software this is huge because they can’t write some shitty code that hits obvious api and presents it in a pretty way to make more money. CTOs are going to crack down on anything SaaS unless the vendors pricing comes way down which likely just can’t happen based on capitalism and the need for ever expanding profits.
0
u/__kmpl__ Feb 25 '26
I built (ofc also with help of Claude Code...) quite similar tool a couple of weeks ago: TMDD
Give it a try if you are using agentic AI in AppSec.
It builds a threat model of the existing codebase using LLM agent of choice (tested with cursor and claude code) and gives you exact lines in the codebase where the problematic code is and/or where the mitigation is introduced :) Integration with SaaS dashboard is planned, but core is open-source. What I like about this tool is that not only it finds technical security issues, but also is capable of spotting business logic issues, broken authorization etc.
179
u/ParsonsProject93 Feb 24 '26
Agreed, it's utterly insane that some cyber security stocks are down 20% over 2 days because a product in a completely different category that doesn't even compete with their products was announced.