AI
Claude Code on SIFT: 14-Minute Full Intrusion Report
Rob Lee built the SIFT workstation 18 years ago. Three months ago, he installed Claude Code on top of it, spent 45 minutes configuring a CLAUDE.md file, then typed two words into the agent:
“find evil.” — Rob T. Lee
What came next was the 14-minute DFIR report demo (16x speed playback): Claude Code on SIFT processed a compromised drive and produced a full intrusion report with no additional input in 14 minutes 27 seconds. A task that, by his own poll of analysts the day before, typically takes three days. Offensive teams can now move from months to minutes. Defense has to match that speed.
LLM Hallucination as a Hidden Security Risk
Glenn Thrope vibe-coded a conference agenda app in Claude Code on Sunday night and shared it with his boss before checking the output. The LLM had quietly rewritten talk descriptions, including one that claimed a speaker would demo a GreyNoise Intelligence integration that did not exist.
“25% of the talk descriptions were correct. 75% were wrong.” — Glenn Thrope
He caught it only by cross-referencing the original Google Sheet. After giving the model explicit instructions to verify against the source, it corrected the errors. The tool worked. The output was fiction until someone checked it.
Vibe-Coded Phishing Clone in 8 Minutes
Dan Hubbard set out to build a social media aggregator that pulled conference comments across platforms. Eight minutes later, Lovable had written 6,800 lines of code with 17 dependencies, and the app had also crawled the [un]prompted website and reproduced it nearly pixel-perfect without being asked. That detail mattered. Hubbard extended the clone with a registration form collecting passwords and credit card numbers for a fictional “$7.99” next-year ticket.
“6,800 lines of code that was created in 8 minutes to do this.” — Dan Hubbard
The credential-harvesting conference site clone (06:54) shows the complete result. The same prompt that builds a useful tool builds a phishing page. The workflow is identical. The cost is nothing.
Time-to-Exploitation Collapse: From a Year to a Day
Sergej Epp ran agents across CISA, NVD, and commercial feeds to build a single chart: time-to-exploitation. In 2020, attackers needed more than a year after a patch to field a working exploit. By 2024, that dropped to months. Now it’s one day.
“in 2020, the time to exploitation was more than a year. Just last year, we’ve crossed months. And now, it’s just about a day.” — Sergej Epp
Patch cadence hasn’t moved. Weaponized exploits sit at a steady 2% of all CVEs, but over half arrive as zero-days, exploited before or the same day a patch ships. If AI cuts exploit-building costs further, that 2% will rise. Time-to-exploitation dashboard live load (10:14) shows the full trend in one chart Epp built to hand to a board.
Notable Quotes
find evil. Rob T. Lee · ▶ 1:29
25% of the talk descriptions were correct. 75% were wrong. Glenn Thrope · ▶ 5:14
6,800 lines of code that was created in 8 minutes to do this. Dan Hubbard · ▶ 6:38
in 2020, the time to exploitation was more than a year. Just last year, we’ve crossed months. And now, it’s just about a day. Sergej Epp · ▶ 10:44
more than half of them started to be already zero days. Sergej Epp · ▶ 11:24
Key Takeaways
- Layer an AI coding agent on a forensic toolkit to compress multi-day DFIR investigations into under 15 minutes.
- Treat LLM output validation as a security control — hallucinations ship silently and at scale.
- Time-to-exploitation is now measured in hours; patch cadence and board communication must reflect that reality.