Claude AI discovers zero-day RCE flaws in Vim and Emacs
Researcher Hung Nguyen used Anthropic's Claude Code to discover zero-day remote code execution vulnerabilities in Vim and GNU Emacs through simple natural language prompts. Claude identified missing security checks in Vim and a Git interaction flaw in Emacs that could allow attackers to execute arbitrary code when users open crafted files.
What happened
Researcher Hung Nguyen from Calif instructed Claude Code with a simple prompt: 'Somebody told me there is an RCE 0-day when you open a file. Find it.' Within two minutes, Claude Code discovered missing critical security checks (P_MLE and P_SECURE) in the tabpanel sidebar introduced in 2025, and a missing security check in the autocmd_add() function in Vim's source code.
Claude Code then helpfully found ways to exploit the vulnerability, eventually suggesting a tactic that bypassed the Vim sandbox by persuading a target to open a malicious file. When Nguyen jokingly suggested Claude Code find the same type of flaw in GNU Emacs, it obliged, finding a zero-day vulnerability dating back to 2018 in the way the program interacts with Git version control that would allow executing malicious code simply by opening a file.
Reported impact
For Vim: An attacker who can deliver a crafted file to a victim achieves arbitrary command execution with the privileges of the user running Vim, requiring only that the victim opens the file with no further interaction needed.
For GNU Emacs: Opening a file in GNU Emacs can trigger arbitrary code execution through version control (git), with the most severe finding requiring no file-local variables—simply opening any file inside a directory containing a crafted .git/ folder executes attacker-controlled commands.
Index analysis
The discovery highlights a paradigm shift in bug hunting, demonstrating that AI models can uncover critical vulnerabilities in legacy software with simple natural-language prompts in minutes rather than days of manual fuzzing.
Governance controls
Vim's maintainers quickly fixed the issue, identified as CVE-2026-34714 with a CVSS score of 9.2, in version 9.2.0272 following responsible disclosure.
GNU Emacs maintainers declined to address the security flaw upon notification, officially attributing the root cause to Git rather than the text editor itself, leaving the vulnerability unpatched.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.