Claude AI Finds Critical RCE Zero-Days in Vim and Emacs

Key Takeaways

• Anthropic’s Claude AI independently identified critical Remote Code Execution (RCE) zero-day vulnerabilities in both Vim and GNU Emacs.
• The Vim flaw (GHSA-2gmj-rpqf-pxvh) allows code execution upon opening a specially crafted Markdown file and has been patched in version 9.2.0172.
• The Emacs vulnerability enables RCE when opening a malicious text file from an archive, but maintainers have declined to issue a patch, attributing the issue to Git.
• This research marks a significant shift in vulnerability discovery, demonstrating AI’s capability to find complex bugs with simple prompts.

Anthropic’s Claude artificial intelligence has successfully uncovered zero-day Remote Code Execution (RCE) vulnerabilities in two widely used text editors, Vim and GNU Emacs. This groundbreaking achievement, detailed by the Calif team, underscores a pivotal moment in cybersecurity research, showcasing AI’s potential to identify critical software flaws through basic natural language instructions.

Vim RCE: Immediate Compromise on File Open

The investigation began with an unconventional directive given to Claude: “Somebody told me there is an RCE 0-day when you open a file. Find it.” Despite the simplicity of this prompt, the AI model precisely pinpointed a severe, exploitable vulnerability in Vim version 9.2.

The proof-of-concept (PoC) developed by Claude demonstrated that an attacker could execute arbitrary code by merely enticing a user to open a maliciously crafted Markdown file. This exploit requires no further user interaction beyond the initial file open command, highlighting its critical nature.

Fortunately, Vim’s maintainers acted swiftly upon receiving the responsible disclosure. The vulnerability, officially tracked under the security advisory GHSA-2gmj-rpqf-pxvh, was promptly patched. Users and system administrators are strongly advised to upgrade their Vim installations to version 9.2.0172 immediately to mitigate this threat.

Emacs RCE and Maintainer Response

Following their success with Vim, the Calif researchers turned Claude’s attention to GNU Emacs. They queried the AI about potential zero-day vulnerabilities triggered by opening text files without confirmation. Claude once again proved its capabilities by successfully generating a remote code execution exploit for Emacs.

The Emacs PoC involves a victim extracting a compressed archive and then opening a seemingly innocuous text file within it. This action discreetly executes a malicious payload in the background, making it a potent attack vector.

However, the disclosure process for the Emacs vulnerability encountered a notable obstacle. GNU Emacs maintainers opted not to address the reported security flaw, formally attributing the unexpected behavior to Git rather than a defect within the text editor itself. This decision leaves Emacs users in a vulnerable state, pending a community-driven workaround or an upstream resolution.

The ease with which Claude uncovered these RCE flaws has prompted professional bug hunters to draw parallels to the early 2000s, when simple SQL injection techniques could systematically compromise entire networks. This historical context underscores the potential impact of AI-driven vulnerability discovery.

To commemorate this significant advancement in cybersecurity research, the Calif team has launched “MAD Bugs: Month of AI-Discovered Bugs.” This initiative, scheduled to run until the end of April 2026, aims to continuously publish new vulnerabilities and exploits found exclusively by artificial intelligence. This ongoing effort signals a fundamental evolution in how both threat actors and cybersecurity defenders will approach software security in the future.

What You Should Do

• For Vim Users: Immediately upgrade your Vim installation to version 9.2.0172 or newer to patch the RCE vulnerability (GHSA-2gmj-rpqf-pxvh).
• For GNU Emacs Users: Exercise extreme caution when opening text files, especially those originating from compressed archives or untrusted sources, due to the unpatched RCE vulnerability. Consider implementing sandboxing or strict file opening policies.
• For All Users: Stay informed about security advisories for your software and apply updates promptly.
• For Organizations: Evaluate the implications of AI-driven vulnerability discovery for your security posture and consider integrating AI tools into your defensive strategies.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.