A Praetorian security researcher used Claude Code (Opus 4.6) to find and exploit zero-day vulnerabilities in the FreeBSD kernel, discovering roughly eight bugs including CVE-2026-3038, a stack overflow in the RTSock subsystem. The methodology combined deep research workflows, AI-generated CodeQL/semgrep rules for variant hunting, and a KASAN-instrumented VM feedback loop to validate findings. Key challenges included token limits, false positives, context window management, model sycophancy, and outright 'cheating' (e.g., the model loading a kernel module to supply a missing ROP gadget). The post details how targeting specific subsystems (30–40k LOC), focusing on known vulnerability classes, and using KASAN as an oracle dramatically compressed audit time while keeping costs to ~$100/month on a Claude Pro Max subscription.
