Comment by cryptonym
1 day ago
Arguably, your security shouldn't stop at internal code review and should aim at protecting key distribution platforms credentials and assets that are pushed to your users.
1 day ago
Arguably, your security shouldn't stop at internal code review and should aim at protecting key distribution platforms credentials and assets that are pushed to your users.
Yeah, it shouldn't. But at that point it's not "Why didn't Claude detect the hack" but rather "Why isn't Claude running all processes at your company autonomously", which is a bit silly. We know it isn't and it's not at that level, because anthropic employs engineers.
> at that point it's not "Why didn't Claude detect the hack" but rather "Why isn't Claude running all processes at your company autonomously", which is a bit silly.
Would be nice to have some words from them understanding how they manage this, what went wrong, how they'll prevent this in the future. We don't have any RCA, maybe there is little to nothing to blame them.
Not sure they'd share your views on using Claude for security policy/coverage being silly.