Claude Found a Path to God Mode in Five Minutes

It took Claude five minutes and 31 seconds to find a path to what was effectively god mode in an application. I gave it a short incident scenario: assume someone had gained access, downloaded the available data and corrupted other records, then determine how their privileges could have been escalated. Claude identified how it was possible and laid out the sequence. The useful lesson is not that one model is unusually dangerous. It is that the cost of reasoning about an attack path has collapsed, for defenders and attackers alike.

That is genuinely good news if you build software. A focused security review once required scarce specialist time, a carefully prepared engagement and enough budget to justify the exercise. Those things still matter for serious assurance, but they are no longer the only way to begin. A developer can now describe an abuse case, give an AI appropriate access to a test environment and ask it to trace authorisation decisions across the solution. In minutes, it can challenge assumptions that have survived design reviews, code reviews and ordinary feature testing.

The uncomfortable part is that an attacker can use the same capability. They do not need your organisational context or a complete architectural map. They can begin with whatever the application exposes, form hypotheses, automate the tedious parts of investigation and refine their approach quickly. A flaw that once demanded patience and uncommon expertise may now be discoverable through persistence, good prompting and inexpensive tooling. “Too obscure to find” was never a sound security control, but it is becoming a particularly reckless one.

Privilege escalation is also rarely one dramatic mistake. It is often a chain of individually reasonable decisions: a trusted client sends an identifier, an endpoint checks authentication but not ownership, a background operation inherits broader permissions, or an administrative path relies on a role claim that is not revalidated. Feature testing tends to confirm that an intended user can complete an intended action. Adversarial testing asks whether the wrong user can reach the same outcome by changing the order, context or shape of those actions. AI is remarkably useful at exploring that gap.

The right response is not to point an agent at production and celebrate whatever happens. Test only systems you own or are explicitly authorised to assess. Use a controlled environment with synthetic data, constrained credentials, useful audit logs and a clear stop condition. Ask the model to state its assumptions, separate observed evidence from inference and propose the smallest test that could confirm each hypothesis. Record the prompts, tool calls and results. A fluent explanation is not proof, and an apparent exploit should be reproduced and reviewed before it is treated as a finding.

Start with outcomes rather than generic instructions. Ask how an ordinary account might read another tenant’s records, change data it does not own, invoke an administrative operation or retain access after its role changes. Then inspect every boundary the proposed route crosses. The most valuable result may not be a spectacular exploit. It may be the discovery that authorisation is enforced inconsistently, that a service account is too powerful, or that monitoring cannot distinguish bulk access from normal use.

Once a path is confirmed, fix the class of failure rather than only the demonstrated route. Put authorisation on the server at every sensitive operation. Check the relationship between the actor and the specific resource, minimise service permissions, make destructive actions harder to perform at scale, and alert on unusual access patterns. Then preserve the scenario as a regression test. The five-minute discovery is useful only if it produces a durable change in the system.

AI-assisted penetration testing does not replace a professional assessment, a threat model or careful engineering. It gives teams a fast, accessible way to interrogate their own assumptions before someone else does. That should make security work more common, not more casual. If an AI can find your path to god mode in five minutes and 31 seconds, the important question is not whether the model was clever. It is whether you asked it first.