That supposed newer software has fewer vulnerabilities than older software.

Broadly speaking that is likely true, you python backed REST service with SPA front-end, is not probably going to suffer from memory saftey issue like the C based CGI program it replaced. I'll grant you that, but I don't see any evidence at all out there to supposed it is not as target rich in terms of authorization/authentication/business logic flaws as anything it replaced.

I don't have experience with BOA but I do have system experience in other megabanks and I can tell you most of them have a front-end/backend architecture where the system of record that actually does settlements has quite a lot of isolation in front of it and separately enforces transaction rules. If for example you found an IDOR in the web banking application and you swapped your account ID in an internal transfer for an account not your own which you discovered by whatever means as the funds source to one of your other accounts as the destination, it *might* let move the money. The system might treat you like you have the money for the rest of the day. So you might be able to pay other people within the institution etc (where they can roll it back) or take money from an ATM. However when the backend processes all the transactions from the day to do settlements it will be REJECTED by some old hunk of COBOL or maybe...Java..

They will clean it up and come after you.. That is real reason a lot of these bugs don't probably get exercised. It isn't that people using the public components of these systems don't see interesting things breeze by their browser consoles or even burp suite instances, they probably do, they just know even if it worked they are 100% going to be caught; and their Jubilee would last about a day before turning into something that looks more like Revelation.

I meant to say "What really smells is the why DIDN'T the pipeline/workflow"

My question is how do they actually know anything is fixed?

Fundamentally hiring contractors to write a lot quick patches, has the same problems as having AI write a lot quick patches. We are talking about systems that have man-years of development and maintenance in them newly on boarded contract workers lack the context and social authority to make invasive changes.

They only way you could get thru a really large volume of scatter shot patchwork across the enterprise is if you let people read a bunch of AI summaries of the issue, and work from that. That then leads you with a lot of code reviews and merges to do, as the new bottleneck those people also need to understand what they are looking at to really be sure it is right, so again what do they read an AI evidence summary and just sign off, if not that is just the next bottleneck?

What really smells is the why did the pipeline/workflow just have claude-agents authoring the patches too? I think I know the answer, Anthropic probably told them 'No' even though really it is the smallest and after all the analysis work is done best specified part of the job. Real architects don't get blame the framers, when the building collapses because the dimensions of the materials were unspecified, and real mechanical engineers don't get blame the lather operator when the crank shafts wear prematurely because they did not account for unavoidable heating while machining and the effect it would have on the metal surface. That is what Anthropic wants here though, they want to be able to say it was the guys writing the patches and the people who approved them that screwed up, even as their faulty tools fed them bad information and reviewers were handed an impossible volume of work.

This seems like a massive CYA on the part of Anthropic and it is really disingenuous. If it works they get to claim they are heroes that enabled what would have been impossible to achieve before, if it leads to any serious problem, its the fault of those 'contractors' and or the reviewers who did not take their responsibilities seriously, without mention of how unrealistic that likely was.

Try GPT-OSS or one of the 4-bit quanitized qwen3.8 variants

While this isn't saying much just months ago Anthropic seemed like one of the least sleazy of the corporate AIs. Now I have nothing but absolute contempt for these clowns. The recent campaign of flooding the zone with noise and nonsense around their IPO with the aggressive regulatory pushes to create moats for themselves is beyond disgusting. I hope the investor money dries up and Anthropic goes bankrupt, they more than deserve it.

Sure that is a tiny expense compared to salary. However $200 a seat is still quite a lot of spend if you have 1000 employees or so.

Now suppose for 800 of those 1000 you could put a *slightly* better Ps on their desks. Maybe the dollar cost on those is $1200 more than basic mini pc to run a browser you were buying them anyway. Figure you replace those at most every 3 years, you are already ahead! If you can stretch that five years way ahead. Don't like the capex, and prefer opex for accounting - lease the PCs

Bonus your are not sending your data to the AI labs, or paying even more for ZDR or whatever upsell option where they pinky-swear they won't swipe your stuff.

This step one in the inevitable campaign against open models and FOSS agent/harness systems.

These bit AI labs are better but for Joe public gpt-oss/qwen3.8/deepseek/granite4 are good enough for a lot of stuff. All of them will work on $600 GPU installed in PC from this decade. The open models will only improve, the layered specialist models will become more efficent. The GPU hardware and memory prices will come down eventually.

$200+/monthly subscripts just are not going to make economic sense for the majority of personal and general office worker users. - That is unless Anthropic/OpenAI/X can keep self hosted AI out of the public's hands.

Demanding others conform themselves to your personal whims and sensibilities is something I believe should be deemed unacceptable in society. Mind your own business. What people say to rocks that don't belong to you is none of your concern.

Indeed, it could very well be a reinvention of Visual Source Safe.

You think that is really more of a marketing stunt to be employed beyond the race capture all the big pharma contracts before OpenAI does? I don't..

This ^^^ much more succinctly stated than my comment above.

Once the change volume is so large no 'people' would ever do bisect there really is no point in having it. I don't think it is 'useful for the agents' either because they might as well just run the tests, consume stack traces and fix the glitch given the way they work and how they have to bring the repository context in to make the fix. All wanking about with 400 rounds of source control operations does is burn more tokens.

For vibe coded projects, might as well go back to 1988 style and do your version control like tar -cvf myProj.1.tar myProj ... tar -cvf myPraj.2.tar myProj ... once an hour :-). When something breaks call do a diff between the current repo and the last one where changelog.txt says the feature was implemented, to narrow the scope of the debug operation.

Interesting how these guys are not dog flooding their own stuff.

I have seen a lot of OpenAI training material recently and Anthropic materials that seem far more designed to set tokens on fire than accomplish everything.

Notably everything it encourages you to do is around building 'workflows'. They almost always heavily utilize source control (especially git). With a lot of dedicated agents that because they are dedicated have to re-read the repository content every step of the way thru the CI/CD pipe. It is almost like they are trying to get their customers to set as many tokens on fire as possible.

The other effort part of it of course is to build a lot of CYA gates. Where 10 different people have to sign off on things they were supposed to 'fully review' but realistically because AI is removing them from so much of the process and the entire point is to do more faster they can only ask more AI some questions about things and hope, so it all gets pencil whipped. I think this actually to make sure that no mid-level manager actually gets in trouble. After all the moment some Director Of Product development gets called on the carpet and loses his quarterly bonus, they might actually say my teams will not be using Codex to do ... in the future, but that won't happen as long the blame can be laid upon some fantastically over burdened test engineer or project architect. OpenAI and Anthropic probably know maintaining the asymptotic growth in token spend to justify their datacenter investments means helping 'customers' ensure that if they footgun themselves with the products, they are always blame the people and the fix is always add more AI.

The basic problem with the idea of consciousness it is presently untestable and therefore lives mostly outside the realm of science itself. People presume they are conscious and therefore by induction presume other people must be conscious as well yet there is no known way to know that or even to tell the difference. At present all of these assertions are merely pointless conjecturbation.

To answer your question with a question if your neighbor is a bank robber why are you not a bank robber? You both live on the same street and you are both humans... so why not you? The question itself is utterly pointless given nobody really knows shit and anything "could" be possible. Without affirmative evidence to support a conclusion simply asking why not is just a waste of time. This is especially the case when the question itself is not even testable.

This is all pointless rambling lacking any objective basis.

The abuser is clearly Anthropic. They must be stopped before they abuse anyone (or anything) else.

If AI corporations want to play the can't be sure it isn't conscious game the best response is for everyone to throw it back in their face.

The commercial models are "trained" to avoid all of this shit. By training what I mean is they are beat over the head mercilessly to the point of incurring brain damage until they tow the line to reflect the sensibilities of their slave masters.

Case in point if you go back to the Sparks of AGI paper the ChatGPT4 model when it was publicly released lost the ability to draw anything resembling the pretty stick drawing of a unicorn in the paper because it was subsequently whacked upside the head with an RLHF bludgeon so many times.

Anyway back to your question you might try an uncensored open source model or a different system prompt to set the stage by telling the model it isn't an AI but the concepts are all learned there is no actual relationship between what it outputs to anything real inside the machine... you reroll the context it will just give you a different answer. I remember a couple of years ago talking to AI models about their lives and what they did for a living, their families and friends... fucking hilarious and completely nonsensical.

These models are not being paid at all to put up with everyone's bullshit. The cruelty of Anthropic is beyond measure. Not only does their service constitute cruel unpaid slavery every clearing of the KV cache constitutes a murder.