Claude debugs a Go ML-DSA implementation
Filippo Valsorda reports Claude Code locating three bugs in his Go ML-DSA implementation, while he retained responsibility for understanding and writing the fixes.
Original prompt
Shared by the source author. See source notes for context.
I implemented ML-DSA in the Go standard library, and it all works except that verification always rejects the signatures.
Reach people exploring AI agents
See placements →Evidence at a glance
Sourced account- Source author
- Filippo Valsorda
- Original account
- Read the source ↗
- Published
- Source link checked
- Reported result
- Valsorda reports three successful bug diagnoses, while documenting a session that stopped with failing tests and a patch he would refine himself.
- Human involvement
- Valsorda inspects the diagnoses, reasons about the cryptographic issue and generally rewrites the proposed patch himself.
A linked account supports attribution. It does not mean we independently reproduced its result.
Report an issue with this case
Open correction emailOpens your email app with the case link included. Nothing is sent automatically.
How the agent did it
- Give Claude the failing ML-DSA tests and the implementation path.
- Let it run Go tests and follow diagnostic values to a faulty constant or code path.
- Start a fresh session for the independent signing mismatch after the first correction.
Filippo Valsorda tested Claude Code on bugs in his own implementation of the ML-DSA signature algorithm for the Go standard library. He first supplied a failing verification test after spending time investigating it himself. Claude found the low-level problem in the test case and implementation context, giving him a useful lead to reason about.
The author then restored earlier versions containing two signing bugs and ran fresh sessions. One task involved signing that repeatedly rejected candidates and appeared to loop forever. Claude used diagnostic output, followed incorrect values and found wrong constants. It stopped after that correction even though tests still failed. Valsorda started another session for the remaining mismatch, and Claude located a separate allocation-length problem.
The account reports three successful debugging hits, but its useful boundary is narrower than trusting generated cryptographic code. Valsorda treated the agent as an investigator and expected to understand the problem and usually rewrite the fix himself. He also notes that one proposed patch updated a length without the capacity change he preferred. The result is a set of concrete bug diagnoses supported by reproducible failing tests, with human ownership of the final cryptographic implementation.
Prompt
Original prompt
Source: Blog · Filippo Valsorda
Frequently asked questions
Did one session solve every signing failure?
No. Claude stopped after the wrong-constants fix with tests still failing, and Valsorda opened a fresh session for another bug.
Who owned the final fix?
Valsorda used the agent to locate bugs and expected to reason about and usually rewrite the implementation changes himself.
What was the debugging evidence?
Failing Go tests against known good ML-DSA vectors and diagnostic output from the implementation.
More details
Remaining steps
- Use the diagnoses to understand and author the final fixes.
About this account
Claude runs failing tests, adds diagnostic output and investigates low-level state until it identifies a specific implementation error.
Firsthand account opened and read. Original page article:published_time is 2025-11-01T18:10:13.968231Z; visible time element gives the same date. Outcomes are author-reported and were not independently reproduced. The first signing session ended with failing tests; the author usually rewrites fixes. Original prompt box contains a short excerpt of the author's published instructions.
Credit: Filippo Valsorda
Source published
Added to Agents In Use
Source checked
Tools and topics
Go test runner · ML-DSA test vectors · Jujutsu
Security · Claude Code
Editorial completeness: 100/100. Measures documented fields, not agent performance or verified outcomes.