PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

We Benchmarked Opus 4.7 on Vulnerability Validation. Here's What We Found.

hackerone.com | research | #ai-security | #benchmark | #claude | #triage | #false-positives | #hackerone | #vulnerability-validation | #opus-4-7
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

HackerOne ran Claude Opus 4.7 through two vulnerability validation benchmarks, finding its biggest gains in filtering invalid findings and producing more accurate, evidence-backed verdicts for triage teams.
Published
Collected

Related coverage

research · nebusec.ai
Beyond the Model: Benchmarking Codex Security, Claude Security, and Nebu
Nebu benchmarks its security pipeline against Codex Security and Claude Security on 76 known bugs; with GPT-5.4 it matches the best Codex result in less time at lower cost.
blog · hackerone.com
Measuring The Fix: How We Evaluate Frontier Models on Remediation Quality
HackerOne tested frontier models on security fix quality and found the judge mattered more than the model. See how CTEM remediation earns engineer trust.
research · hackerone.com
GPT-5.5 vs Claude Opus 4.7 vs Sonnet 4.6: OpenAI's Frontier Cyber Model Faces Anthropic's Best on Vulnerability Validation
HackerOne benchmarked GPT-5.5 against Claude Opus 4.7 and Sonnet 4.6 on CVE cases and real-world vulnerability reports, judging which frontier model validates exploitability with the best speed-accuracy balance.
research · portswigger.net
Beware the false false-positive: how to distinguish HTTP pipelining from request smuggling
Kettle explains how to distinguish HTTP pipelining false positives from real request smuggling, covering connection-locked smuggling, connection state attacks and client-side desync.
research · portswigger.net
Responsible denial of service with web cache poisoning
James Kettle shows how web cache poisoning can take down websites with a single request without collateral damage, earning bounties from Tesla and HackerOne along the way.
research · bishopfox.com
Separating Signal from Slop: Triaging CVEs in the Age of AI Security Research
CVE disclosures are up 85% while exploitation barely moved. Bishop Fox breaks down four Nginx CVEs that looked critical but rarely affect real deployments.
Back