I don't think so. I've never had Claude reject the idea of finding a vulnerability (unlike ChatGPT). The issue is that it's limited by its training set. It'll be trained on things like UAF, it won't be trained on things like "the way your secrets are injected + the way you make HTTP requests + the way you deploy means that an SSRF can expose your private key" or whatever, and that's a technology limitation.