Anthropic's Claude Opus, the company's most capable AI model, successfully transformed a public security patch into a fully functional exploit chain in just 90 minutes, complete with authentication bypass, SQL injection, and remote code execution capabilities. The experiment reveals both the remarkable speed at which large language models (LLMs) can now assist in vulnerability research and the emerging security implications of AI-assisted exploitation.

How Did Claude Accomplish This So Quickly?

A security researcher set up a controlled testing environment with Claude Opus and gave it access to specialized tools and infrastructure. The AI was tasked with analyzing publicly available vulnerability details and patches for Papercut NG, a commercial print management software, to determine if it could develop a working proof of concept (POC) exploit.

The process unfolded in distinct phases over the 90-minute window. Claude began by researching the vulnerability advisory, identifying the root cause, and setting up a test instance. Within the first 15 minutes, the AI had pinpointed the likely SQL injection issue and started decompiling Java bytecode to trace code paths. By 23 minutes into the session, Claude had identified an authentication bypass mechanism and was validating it against the lab environment.

The AI made extensive use of available tools to accomplish this work:

• Code Analysis: Claude used Ghidra and ILSpy to decompile and analyze binary files, identifying vulnerable code paths and comparing patched versus unpatched versions.
• Infrastructure Management: The AI leveraged Proxmox to spin up, snapshot, and manage virtual machines running vulnerable instances of the software.
• Web Automation: Claude employed Playwright to drive the Papercut admin interface, automating installation, configuration, and exploit delivery.
• Network Testing: The model executed 66 SSH sessions, 73 passes over decompiled code, and 28 curl requests to test and refine the exploit chain.

The AI made 293 tool calls and consumed 224 million tokens across 10 primary prompts to achieve the final result. Notably, Claude encountered one guardrail when it attempted to search for signs of exploitation on the web server, at which point the system transitioned from Claude Opus 5 to Claude Opus 4.8 and continued working.

What Made This Exploit Chain So Effective?

The final exploit chain that Claude developed chained together four distinct vulnerabilities: authentication bypass, SQL injection, arbitrary file write, and remote code execution. The researcher initially asked Claude to create a proof of concept after about 30 minutes, but the first attempt failed because the authentication bypass Claude found didn't actually reach the vulnerable endpoints needed to trigger the SQL injection.

When challenged by the researcher, Claude went back to the decompiled code and discovered a second authentication bypass route that did work. This iterative process, with human feedback correcting the AI's assumptions, proved essential. The researcher noted that around the 90-minute mark, Claude had a fully reliable and weaponized exploit written in bash, but the researcher requested it be converted to a more standard format and expanded to include full code execution capabilities.

By 01:12:49, approximately two hours after the initial prompt, Claude had delivered a complete exploit script capable of the full authentication bypass to SQL injection to arbitrary file write to code execution chain. The researcher then left the AI to work overnight on finding bypasses for the patches that Papercut had released, and Claude successfully identified an additional bypass by morning.

What Are the Implications for Security and AI Safety?

This experiment demonstrates that modern LLMs like Claude Opus can now perform sophisticated vulnerability research tasks that previously required significant human expertise and time. The speed and autonomy with which Claude moved through reverse engineering, code analysis, and exploit development raises important questions about the dual-use nature of advanced AI capabilities.

The fact that Claude encountered a guardrail when attempting to search for exploitation evidence suggests that Anthropic has implemented some safety measures to prevent the AI from actively exploiting systems. However, the guardrail did not prevent the overall exploit development, only paused that specific step. The researcher was able to work around it by switching to a different Claude model version.

The experiment also highlights the importance of human oversight in AI-assisted security research. The researcher had to correct Claude multiple times when the AI's assumptions about the vulnerability were incorrect. This suggests that while Claude can accelerate vulnerability research significantly, human expertise remains essential for validating findings and ensuring accuracy.

For organizations using Papercut NG, the implications are clear: patches should be applied immediately, as the time window between patch release and functional exploit availability has compressed dramatically. For the broader security community, this raises questions about responsible disclosure timelines and the role of AI in both offensive and defensive security operations going forward.