Proof of concept
Also called PoC, proof-of-concept exploit, reproduction steps, working reproduction
A small demonstration that a security flaw is real: the exact input or steps that make the problem happen on a stated version.
A proof of concept is the difference between "this code looks wrong" and "watch what happens when I send this". It is usually short: an input, a request or a small script, with the version it was tested on, that anyone can run to see the flaw for themselves.
For the person receiving a flaw report, it is the cheapest test there is. Reading a long description and tracing it through the code can take a long time. Running the steps on a test copy takes far less, and the result doesn't depend on how well the report is written.
That is why it matters more now that AI writes reports. A model can produce confident prose about a flaw that doesn't exist, but it can't make the steps succeed. Asking for a proof of concept moves the cost of an invented report back to its sender.
For example
A flaw report includes a 12-line script and the version number. You run it on a test copy, the server crashes as described, and the report is confirmed.
Put it to use
Where you'll meet proof of concept in ChatGPT, Gemini and Claude, how to use it there, and the mix-up most people make.
Daily Bytes Plus is in the Android app.