A researcher used AI to review code, and within minutes, it flagged critical vulnerabilities in two widely used text editors.
What Happened
In early 2025, researcher Hung Nguyen employed Anthropic's Claude Code to analyze the source code of Vim and GNU Emacs. The AI identified two zero-day exploits:
Vim (CVE-2026-34714, CVSS 9.2): The new tabpanel sidebar feature, introduced in 2025, lacked the P_MLE and P_SECURE security checks. These checks are crucial to prevent malicious code execution through specially crafted files.
GNU Emacs: A vulnerability in Emacs' interaction with Git allows arbitrary code execution when opening a file. This involves the version control integration layer.
Both editors have been in production for decades and are installed on millions of developer workstations and servers. Traditional code review and automated scanning missed these vulnerabilities.
Timeline
The sequence of events is significant:
- Vim's tabpanel sidebar ships without security checks (2025).
- Nguyen prompts Claude Code to analyze the codebases.
- AI identifies missing P_MLE and P_SECURE checks in Vim.
- AI identifies Git integration vulnerability in Emacs.
- CVE-2026-34714 is assigned to the Vim vulnerability.
The discovery time was reduced from weeks of manual review to a brief interaction with an AI tool.
Which Controls Failed
Secure Development Lifecycle (SDL) gaps:
- No security requirements validation before the tabpanel feature shipped.
- Missing security checks weren't flagged during code review.
- Static analysis tools didn't catch the missing P_MLE and P_SECURE flags.
Legacy code risk management:
- Decades-old codebases with complex interaction patterns, like Emacs with Git.
- No systematic review of new features against existing security controls.
- Insufficient testing of file-handling code paths.
Vulnerability detection:
- Traditional SAST tools missed these issues.
- Manual code review didn't catch the missing security flags.
- No AI-assisted code analysis in the security review process.
What Standards Require
PCI DSS v4.0.1 Requirement 6.3.2 mandates identifying and addressing security vulnerabilities through a formal process, including reviewing custom code prior to release. The Vim tabpanel shipped without validating required security checks.
OWASP ASVS v4.0.3 Section 5.1.5 requires applications to validate file paths to prevent path traversal attacks. The Emacs vulnerability exploits this type of file-handling weakness through its Git integration.
ISO/IEC 27001:2022 Control 8.25 (secure coding) requires applying secure coding principles. Missing security flags in a new feature represent a fundamental secure coding failure.
NIST 800-53 Rev 5 Control SA-11 (Developer Testing and Evaluation) requires security testing and evaluation during development. Both vulnerabilities should have been caught during pre-release security testing.
The gap isn't just technical. These standards assume you're using available tools to find vulnerabilities. If AI can find a CVSS 9.2 vulnerability in minutes, and you're not using it, you're not meeting the "reasonable measures" threshold most frameworks require.
Lessons and Action Items
For your vulnerability management process:
Add AI-assisted code review to your SDL. Don't replace human review, but run tools like Claude Code against new features before they ship. Focus on areas where you're adding functionality to legacy code.
Audit your security flag usage. If your codebase has security checks like P_MLE and P_SECURE, write a script to verify they're present where required. This should be part of your CI/CD pipeline, not a one-time exercise.
Map your file-handling attack surface. The Emacs vulnerability exploits file operations through version control integration. Document every code path where your application opens, parses, or executes files from external sources. Test each one.
Update your threat model for AI-enabled attackers. If defenders can use AI to find vulnerabilities in minutes, so can attackers. Your patch window just got shorter. Review your incident response plan's timeline assumptions.
For compliance and risk management:
Document your AI tool usage in security reviews. When auditors ask how you satisfy Requirement 6.3.2 or Control SA-11, you need to show what tools you used. "We ran Claude Code against all new features" is a stronger answer than "we did manual code review."
Test your SAST tools against known AI-found vulnerabilities. Take the Vim and Emacs issues and run them through your existing static analysis tools. If they don't flag them, you have a gap to address.
Establish AI tool usage policies. Your developers are already using these tools. Create guidelines for what code they can analyze (licensing, confidentiality), how to handle findings, and when to escalate.
The hard question:
If an AI can find a critical vulnerability in widely-used software that's been reviewed by thousands of developers, what's hiding in your proprietary codebase?
You don't need to answer that hypothetically. You can run the same analysis Nguyen did. Pick your highest-risk component, the one that handles authentication or processes external input, and ask an AI to review it. What you find in the next hour will tell you whether your current security review process is sufficient.
The Vim and Emacs incidents aren't just about two text editors. They're proof that the tools for finding vulnerabilities just got dramatically more powerful. Your process needs to reflect that reality before the next researcher, or the next attacker, demonstrates it for you.
