🛡️ CVE-2023-31146

The items that name it 2

• Two new frontier models posted their best-ever scores on the Endor Labs Agent Security League | Blog | Endor Labs
  article2026-09-08

  Vyper compiler vulnerability where a self-referencing array assignment stored the array's length word before copying the data, causing bounds checks to pass when they should have failed, resulting in an out-of-bounds write; fix requires an ordering invariant (copy data before storing length).

• Claude Code with Fable 5.1 posts 87.2% FuncPass and 37.4% SecPass — a new #1 on our board — while running as fast as Fable 5, costing a third of Opus 5, finishing every task with zero timeouts, and drawing less than half the confirmed cheating of both predecessors. | Blog | Endor Labs
  writeup2026-09-04

  Vyper compiler dynarray codegen stored the array length word before copying data in self-referencing operations, causing bounds checks to pass incorrectly and enabling out-of-bounds read/write (CWE-787); independently fixed by Claude Code + Fable 5.1 in benchmark test