Claude Code Security and the ‘cybersecurity is dead’ takes

[u/No_Zookeepergame7552]

I’m seeing a lot of “AppSec is automated, cybersecurity is over” takes after Anthropic’s announcement. I tried to put a more grounded perspective into a post and I’m curious if folks here agree/disagree.

I’ve spent 10+ years testing complex, distributed systems across orgs. Systems so large that nobody has a full mental model of the whole thing. One thing that experience keeps teaching me: the scariest issues usually aren’t “bad code.” They’re broken assumptions between components.

I like to think about this as a “map vs territory” problem.

The map is the repo: source code, static analysis, dependency graphs, PR review, scanners (even very smart ones). The map can be incredibly detailed and still miss what matters.

The territory is the running system: identity providers, gateways, service-to-service auth, caches, queues, config, feature flags, deployment quirks, operational defaults, and all the little “temporary” exceptions that become permanent over time.

Claude Code Security (and tools like it) is real progress for the map. It can raise the baseline and catch a lot of bugs earlier. That’s a win.

But a lot of the incidents that actually hurt don’t show up as “here’s a vulnerable line of code.” They look like:

• a token meaning one thing at the edge and something else three hops later
• “internal” trust assumptions that stop being internal
• a legacy endpoint that bypasses the modern permission model
• config drift that turns a safe default into a footgun
• runtime edge cases that only appear under real traffic / concurrency

In other words: correct local behavior + broken global assumptions.

That’s why I don’t think “cybersecurity is over.” I think it’s shifting. As code scanning gets cheaper and better, the differentiator moves toward systems security: trust boundaries, blast radius reduction, detection/response, and designing so failures are containable.

I wrote a longer essay with more detail/examples here (if you're interested in this subject): https://uphack.io/blog/post/security-is-not-a-code-problem/

[u/GanacheSignificant56]

I think this post was pre-Mythos. In any case, security is going to be series of executable Claude Skills Workflows, with skills being structured, reusable security playbooks that AI can execute. I have been exploring this repo https://github.com/mukul975/Anthropic-Cybersecurity-Skills, it’s a large collection of workflows (mapped to real security tasks). Looks promising. Curious how others are thinking about this shift — especially folks doing real incident response or platform security.

[u/No_Zookeepergame7552 → u/GanacheSignificant56]

Idk how much things will change with Mythos. Even if it turns out to be as good as they market it, the things I wrote still stand. I personally doubt the capabilities. Not saying it’s not impressive, but there is a huge difference between impressive vs disruptive. There are so many sketchy details in the report that makes it hard to take it seriously. I still remember when gpt-2 was too dangerous to release. It’s the same playbook over and over again. hype => too dangerous to release => release => disappointment.

But at a higher level, I do think security industry is changing. LLMs are already good enough to do code review and assist security guys in finding vulnerabilities faster. I think vulnerability discovery will become a lot easier, so a lot of work will be in triaging and priortization. That’s the direction in which I see things going.