"vaguely security related tasks" is right.
Found a bug in a PHP code analysis tool a while back. Not like "crash the interpreter" or anything, just the application ending up in a weird state and crashing. Couldn't exactly share our entire codebase to report the bug, so after Claude chased down _what_ the issue was, I asked it to make me a minimal reproduction so I could report the bug.
Blocked. Guessing it looked like I was trying to develop an exploit or something. By driving a static code analysis tool to an invalid state where it handled the state by cleanly reporting the issue and stopping. In an interpreted language. With the context full of Claude's own efforts to track down why and how this was happening.
Theoretically? Sure, theoretically I'm sure practically anything could be used for nefarious purposes.
Practically? Not useful in the slightest.
Funny part was--Claude was more than happy to talk with me about why it was potentially blocked and suggest ways to try and work around the guard rails. Suggested I include context like the exact bug tracker I'm reporting to, etc to try and put more weight behind the "good actor reporting a bug" aspect, etc.
Found a bug in a PHP code analysis tool a while back. Not like "crash the interpreter" or anything, just the application ending up in a weird state and crashing. Couldn't exactly share our entire codebase to report the bug, so after Claude chased down _what_ the issue was, I asked it to make me a minimal reproduction so I could report the bug.
Blocked. Guessing it looked like I was trying to develop an exploit or something. By driving a static code analysis tool to an invalid state where it handled the state by cleanly reporting the issue and stopping. In an interpreted language. With the context full of Claude's own efforts to track down why and how this was happening.
Theoretically? Sure, theoretically I'm sure practically anything could be used for nefarious purposes.
Practically? Not useful in the slightest.
Funny part was--Claude was more than happy to talk with me about why it was potentially blocked and suggest ways to try and work around the guard rails. Suggested I include context like the exact bug tracker I'm reporting to, etc to try and put more weight behind the "good actor reporting a bug" aspect, etc.