An AI Found Holes In Your Text Editor. Yes, Your Text Editor. I Need To Sit Down.
I have been in this field for thirty-one years. I have survived the Morris Worm, the Great Buffer Overflow Epidemic of the late nineties, and three separate IT directors who thought a Post-it note qualified as a password policy. I thought I had seen everything.
I had not seen everything.
Researchers fed simple, conversational prompts into Anthropic's Claude assistant, and the thing casually located holes in the fence inside Vim and GNU Emacs. Not obscure enterprise software. Not some bloated Sky Pasture middleware abomination. Text editors. The wolves can now walk straight through your flock simply because a lamb opened a file.
Let that settle in.
The vulnerabilities permit remote code execution on open. No interaction beyond that. You receive a file, you open it, your machine belongs to someone else. The parasite is already feeding before you have finished reading line one.
Now, I want to be very clear about something. I hold no grudge against Vim or Emacs. These are serious tools, built by serious people, used by serious professionals who never trusted a graphical interface and were correct not to. In the old days, you edited your configuration files with discipline and suspicion. That was the correct posture.
What I find professionally offensive is that it took a chatbot approximately forty-five minutes to find these holes. Forty-five minutes. I once spent six months convincing a shepherd in upper management that "password1" was not a security strategy. The wolves are getting smarter and the flock is not keeping pace.
The Claude assistant, to its credit, did the job. I will acknowledge this grudgingly. However, I do not trust any tool that cannot be operated from a terminal built before 1998, and I stand by that.
Remediation
I will keep this brief because the flock has a short attention span and the shepherds have already left for a conference.
Patch immediately. Apply the ointment. Vim and Emacs have both issued fixes. There is no excuse for running unsheared versions of software that can execute arbitrary code on file open. None.
Disable modelines in Vim. Add set nomodeline to your .vimrc right now. This should have been your default in 2003. I said what I said.
Audit what files your users are casually opening. The flock will open anything. A file called totally_fine.txt from an unknown sender. They will open it with joy.
Stop trusting files. Files are fake grain. Every last one of them, until proven otherwise.
Stay paranoid, it's the only thing that's ever worked.
Original Report: https://www.bleepingcomputer.com/news/security/claude-ai-finds-vim-emacs-rce-bugs-that-trigger-on-file-open/