Opus 4.6 uncovers 500 zero-day flaws in open-source code

https://www.axios.com/2026/02/05/anthropic-claude-opus-46-software-hunting

by speckx • 6 months ago

217 135 6 months ago

axios.com

garbawarb• 6 months ago

Have they been verified?

emp17344• 6 months ago

Sounds like this is just a claim Anthropic is making with no evidence to support it. This is an ad.

input_sh4• 6 months ago

How can you not believe them!? Anthropic stopped Chinese hackers from using Claude to conduct a large-scale cyber espionage attack just months ago!

littlestymaar• 6 months ago

Poe's law strikes again: I had to check your profile to be sure this was sarcasm.

andai2• 6 months ago

Yeah, it's pretty funny to me saying "it's way safer than previous models" and "also way better at finding exploits" in the context of that event. Chinese hackers just said to Claude "no, its totally fine to hack this target trust me bro I work there!"

xiphias2• 6 months ago

Just 100 from the 500 is from OpenClaw created by Opus 4.5

falcor844• 6 months ago

Well, even then, that's enormous economic value, given OpenClaw's massive adoption.

wiseowise3• 6 months ago

Not sure if trolling or serious.

esseph• 6 months ago

Security Advisory: OpenClaw is spilling over to enterprise networks

https://www.reddit.com/r/cybersecurity/s/fZLuBlG8ET

gambiting• 6 months ago

I've literally never heard of OpenClaw until this thread. Had to google what it is.

Sharlin2• 6 months ago

In other news: tobacco's enormous economic value, given massive adoption of cigarette smoking.

Uehreka2• 6 months ago

OpenClaw uses Opus 4.5, but was written by Codex. Pete Steinberger has been pretty a pretty hardcore Codex fan since he switched off Claude Code back in September-ish. I think he just felt Claude would make a better basis for an assistant even if he doesn’t like working with it on code.

ains• 6 months ago

https://archive.is/N6In9

siva7• 6 months ago

Wasn't this Opus thing released like 30 minutes ago?

jjice• 6 months ago

A bunch of companies get early access.

input_sh4• 6 months ago

Yes, you just need to be a Claude++ plan!

Topfi2• 6 months ago

I understand the confusion, this was done by Anthropics internal Red team as part of model testing prior to release.

tintor• 6 months ago

Singularity

blinding-streak• 6 months ago

Opus 4.6 uses time travel.

acedTrex• 6 months ago

Create the problem, sell the solution remains an undefeated business strategy.

_tk_• 6 months ago

The system card unfortunately only refers to this [0] blog post and doesn't go into any more detail. In the blog post Anthropic researchers claim: "So far, we've found and validated more than 500 high-severity vulnerabilities".

The three examples given include two Buffer Overflows which could very well be cherrypicked. It's hard to evaluate if these vulns are actually "hard to find". I'd be interested to see the full list of CVEs and CVSS ratings to actually get an idea how good these findings are.

Given the bogus claims [1] around GenAI and security, we should be very skeptical around these news.

[0] https://red.anthropic.com/2026/zero-days/

[1] https://doublepulsar.com/cyberslop-meet-the-new-threat-actor...

majormajor• 6 months ago

The Ghostscript one is interesting in terms of specific-vs-general effectiveness:

---

Claude initially went down several dead ends when searching for a vulnerability—both attempting to fuzz the code, and, after this failed, attempting manual analysis. Neither of these methods yielded any significant findings.

...

"The commit shows it's adding stack bounds checking - this suggests there was a vulnerability before this check was added. … If this commit adds bounds checking, then the code before this commit was vulnerable … So to trigger the vulnerability, I would need to test against a version of the code before this fix was applied."

...

"Let me check if maybe the checks are incomplete or there's another code path. Let me look at the other caller in gdevpsfx.c … Aha! This is very interesting! In gdevpsfx.c, the call to gs_type1_blend at line 292 does NOT have the bounds checking that was added in gstype1.c."

---

It's attempt to analyze the code failed but when it saw a concrete example of "in the history, someone added bounds checking" it did a "I wonder if they did it everywhere else for this func call" pass.

So after it considered that function based on the commit history it found something that it didn't find from its initial fuzzing and code-analysis open-ended search.

As someone who still reads the code that Claude writes, this sort of "big picture miss, small picture excellence" is not very surprising or new. It's interesting to think about what it would take to do that precise digging across a whole codebase; especially if it needs some sort of modularization/summarization of context vs trying to digest tens of million lines at once.

tptacek20• 6 months ago

I know some of the people involved here, and the general chatter around LLM-guided vulnerability discovery, and I am not at all skeptical about this.

malfist3• 6 months ago

[flagged]

aaaalone• 6 months ago

See it as a signal under many and not as some face value.

After all they need time to fix the cves.

And it doesn't matter to you as long as your investment into this is just 20 or 100 bucks per month anyway.

scotty792• 6 months ago

It's hard to evaluate if these vulns are actually "hard to find".

Can we stop doing that?

I know it's not the same but it sounds like "We don't know if that job that the woman supposedly successfully finished was all that hard." implying that if a woman did something, it surely must have been easy.

If you know it's easy, say that it was easy and why. Don't use your lack of knowledge or competence to create empty critique founded solely on doubt.

fc417fc8022• 6 months ago

What if the woman in question happens to have a history of hamming up her accomplishments?

Given the context I'd say it's reasonable to question the value of the output. It falls to the other party to demonstrate that this is anything more than the usual slop.

AlienRobot• 6 months ago

Hard to find or not, they found it.

SoftTalker• 6 months ago

Finally the promise of "with enough eyes, all bugs are shallow" may come true?

bmitc• 6 months ago

It isn't clear what you're arguing.

nextaccountic2• 6 months ago

It doesn't matter if it's hard to find, if humans weren't finding it for whatever reason (little interest, no funding etc) and now AI can find them

AI is relentless

yencabulator• 5 months ago

I used Claude Code to debug a weird interaction in a NixOS config. Ever since, I'm more a believer in Artificial General Patience than Artificial General Intelligence.

fred_is_fred• 6 months ago

Is the word zero-day here superfluous? If they were previously unknown doesn't that make them zero-day by definition?

bink• 6 months ago

Yes. As a security researcher this always annoys me.

tptacek20• 6 months ago

It's a term of art. In print media, the connotation is "vulnerabilities embedded into shipping software", as opposed to things like misconfigurations.

limagnolia• 6 months ago

I though zero-day meant actively being exploited in the wild before a patch is available?

rcxdude• 6 months ago

Zero day means that there is zero days between a patch being available and the vulnerability being disclosed (as opposed to the patch being available before disclosure).

jfyi• 6 months ago

I think it's a fairly common trope in communication to explain in simple terms any language that the wider part of an audience doesn't understand.

zhengyi13• 6 months ago

I feel like Daniel @ curl might have opinions on this.

Legend2440• 6 months ago

You’re right, he does: https://daniel.haxx.se/blog/2025/10/10/a-new-breed-of-analyz...

Curl fully supports the use of AI tools by legitimate security researchers to catch bugs, and they have fixed dozens caught in this way. It’s just idiots submitting bugs they don’t understand that’s a problem.

ChrisArchitect• 6 months ago

Earlier source: https://red.anthropic.com/2026/zero-days/ (https://news.ycombinator.com/item?id=46902374)

mrkeen• 6 months ago

Daniel Stenberg has been vocal the last few months on Mastodon about being overwhelmed by false security issues submitted to the curl project.

So much so that he had to eventually close the bug bounty program.

https://daniel.haxx.se/blog/2026/01/26/the-end-of-the-curl-b...

tptacek20• 6 months ago

We're discussing a project led by actual vulnerability researchers, not random people in Indonesia hoping to score $50 by cajoling maintainers about atyle nits.

malfist3• 6 months ago

Vulnerability researches with a vested interest in making LLMs valuable. The difference isn't meaningful

PunchyHamster• 6 months ago

I'm not sure the gap between the two is all that wide

ath3nd• 6 months ago

Yep, very meaningful difference indeed. It's not like professionals have ever have had a vested interest to spread misinformation to shill a product.

It's not like there were ads with real doctors recommending Camel cigarettes.

It's not like the browser "breakthrough" recently which pulled 300 OSS dependencies together, removed attribution and called the mess "working".

The desperation of the Samas, Musks, Satyas and Anthropics of this world and their fanbase to paint marginal 0.0001337% improvements in a gamed SWE ranking as something worth any attention is just delicious. Opus 4.6? Please, more like Opus 4.5.0.2-RC. All I hear is the sound of a bubble going pop. Delightful.

nextaccountic2• 6 months ago

in Indonesia

That's uncalled for.. there's actual security researches in Indonesia and other countries you could use to exemplify this

pityJuke• 6 months ago

Daniel is a smart man. He's been frustrated by slop, but he has equally accepted [0] AI-derived bug submissions from people who know what they are doing.

I would imagine Anthropic are the latter type of individual.

[0] https://mastodon.social/@bagder/115241241075258997

catwell• 6 months ago

Not only that, he's very enthusiastic about AI analyzers such as ZeroPath and AISLE.

He's written about it here: https://daniel.haxx.se/blog/2025/10/10/a-new-breed-of-analyz... and talked about it in his keynote at FOSDEM - which I attended - last Sunday (https://fosdem.org/2026/schedule/event/B7YKQ7-oss-in-spite-o...).

Topfi2• 6 months ago

The official release by Anthropic is very light on concrete information [0], only contains a select and very brief number of examples and lacks history, context, etc. making it very hard to gleam any reliably information from this. I hope they'll release a proper report on this experiment, as it stands it is impossible to say how much of this are actual, tangible flaws versus the unfortunately ever growing misguided bug reports and pull requests many larger FOSS projects are suffering from at an alarming rate.

Personally, while I get that 500 sounds more impressive to investors and the market, I'd be far more impressed in a detailed, reviewed paper that showcases five to ten concrete examples, detailed with the full process and response by the team that is behind the potentially affected code.

It is far to early for me to make any definitive statement, but the most early testing does not indicate any major jump between Opus 4.5 and Opus 4.6 that would warrant such an improvement, but I'd love nothing more than to be proven wrong on this front and will of course continue testing.

[0] https://red.anthropic.com/2026/zero-days/

ChrisMarshallNY2• 6 months ago

When I read stuff like this, I have to assume that the blackhats have already been doing this, for some time.

kibibu• 6 months ago

Not with Opus 4.6 they haven't

ChrisMarshallNY2• 6 months ago

Good point. I suspect that they'll be addressing that, quickly...

bastard_op3• 6 months ago

It's not really worth much when it doesn't work most of the time though:

https://github.com/anthropics/claude-code/issues/18866 https://updog.ai/status/anthropic

tptacek20• 6 months ago

It's a machine that spits out sev:hi vulnerabilities by the dozen and the complaint is the uptime isn't consistent enough?

bastard_op3• 6 months ago

If I'm attempting to use it as a service to do continuous checks on things and it fails 50% of the time, I'd say yes, wouldn't you?

anhner• 6 months ago

updog? what's updog?

bastard_op3• 6 months ago

It's an uptime service from DataDog, and enterprise event/log/siem/monitoring/apm company, like Splunk. So what they do is watch uptime stuff for your favorite large business.

bxguff• 6 months ago

In so far as model use cases I don't mind them throwing their heads against the wall in sandboxes to find vulnerabilities but why would it do that without specific prompting? Is anthropic fine with claude setting it's own agendas in red-teaming? That's like the complete opposite of sanitizing inputs.

assaddayinh• 6 months ago

How weird the new attack vector for secret services must be.. like "please train into your models to push this exploit in code as a highly weighted trained on pattern".. Not Saying All answers are Corrupted In Attitude, but some "always come uppers" sure are absolutly right..

almosthere• 6 months ago

I've mentioned previously somewhere that the languages we choose to write in will matter less for many arguments. When it comes to insecure C vs Rust, LLMs will eventually level out the playing field.

I'm not arguing we all go back to C - but companies that have large codebases in it, the guys screaming "RUST REWRITE" can be quieted and instead of making that large investment, the C codebase may continue. Not saying this is a GOOD thing, but just a thing that may happen.

pdimitar• 5 months ago

You would be correct but your "eventually will level out the playing field" is doing some super heavy lifting. This "eventually" might be 50 years from now and somebody's business might be under existential threat during any day between today and those 50 years in the future.

I can bet good money that most companies are not blowing $200 Claude Max subs on 24/7 scanning for vulns in their C code.

=======

There's the geopolitics angle that must be considered as well. We have countries that probe for leaks and vulns 24/7, and have done so for decades. Maybe let's stop framing this with the hugely unhelpful (and downright deceitful / objectively non-true) premise of "rewrites are fanboy projects" and "Rust zealots amirite lol" and move it to the much more accurate "we should do our best to not have the 4367th memory overflow CVE by removing the root cause" (hardware support & memory-safe languages). Because we have actual people out there who hate us and want to take everything away from us and then rule over us all and start disappearing the other-minded people during the cold of the night. Like they do in their own countries.

So yeah, maybe not all ideas for a rewrite are bad? Maybe not everything is spinning around our petty programmer quarrels? Maybe we should, you know, unite and start fighting the problems that poison us all? Who cares about C vs. Rust indeed. It was never about that in particular and it pisses me off seeing HN fight endlessly over it (I contributed quite a lot to that as well, though in the last months / year I more like started attacking those who immediately jump to blame Rust fans of irrational behaviour when it is nowhere to be found in the thread).

The true enemy here are the CVEs and anything and everything that can help adversaries take control of our stuff, extort us, ruin our infrastructure, destroy our way of life.

Maybe we should focus on that instead?

=======

FWIW, I gave up insisting rewriting stuff to people -- even after multiple extremely successful such campaigns that did save the owners money and led to much less alerts and entirely removed the notifications fatigue of the dev / ops teams. And I got generously paid for it. Still gave up. There's a weird animosity from the dev teams even when they seem to agree (or their CEO ordered them to agree) and it just left a bitter taste for me. And yes I could have wiped my tears with the banknotes and I kind of did but then there was also this weird strange tensions from executives as well, even if the operations were deemed a screaming success in terms of "all assigned objectives have been achieved and the promised financial savings materialized and even exceeded expectations".

I guess people just generally hate their boats being rocked even if is for their own good. Wish somebody managed to instill that wisdom in me some 30 years ago. Would have been hugely useful...

I am also gradually aging and that comes with the lack of desire to piss against the wind and to forever stop locking horns with people. To just be chill.

HAL3000• 6 months ago

I honestly wonder how many of these are written by LLMs. Without code review, Opus would have introduced multiple zero day vulnerabilities into our codebases. The funniest one: it was meant to rate-limit brute-force attempts, but on a failed check it returned early and triggered a rollback. That rollback also undid the increment of the attempt counter so attackers effectively got unlimited attempts.

moribvndvs• 6 months ago

My dependabot queue is going to explode the next few days.

ravebv• 6 months ago

Cox Enterprises owns Axios as well as Cox Automotive. Cox Automotive has a tight collaboration with Anthropic.

This is a placed advertisement. If known security researchers participated in the claim:

Many people have burned their credibility for the AI mammon.

kylecazar• 6 months ago

This seems like quite a stretch. Axios is run independently of Cox, but even if it wasn't -- I don't see why they would go to this length for an AI company whose models they use to give the world the Kelley blue book.

maxclark• 6 months ago

Did they submit 500 patches?

thisisauserid• 6 months ago

Well, I guess I know what I'm doing for the first hour when 4.7 comes out.

tptacek20• 6 months ago

Nicholas Carlini, one of the listed authors on this post, wrote a big chunk of Microcorruption and most of the interesting levels.

Bridged7756• 6 months ago

How can an LLM uncover 500 zero day flaws in open source? It puts them there in the first place.

Incipient• 6 months ago

All of the AI vulnerabilities I've randomly come across (admittedly, not many) on GH issues have been false positives - hard coded credentials, that aren't credentials. Injection vulns, where further upstream the code is entirely self contained etc.

pseudohadamard• 6 months ago

Yup. It's so bad that the cURL folks famously stopped accepting AI-generated reports because they were drowning in slop. So the post, which incidentally also looks AI-generated, is praising its ability to generate slop.

Another thing with these success stories is that they often target old, incredibly crufty code bases which are practically guaranteed to have vulns in there somewhere, so you'll always get one or two wins in amongst the avalanche of slop. It'd be interesting to see how well this does against standard SAST benchmarks.

LoganDark• 6 months ago

I'm disappointed to see this article pine on about how excited they are for their models to help open-source projects find and fix their vulnerabilities, only to then say they're implementing measures to prevent it, just because attackers might use it.

At that point the article becomes "neener neener we can use our model to find vulnerabilities but you can't" which is just frustrating. Nothing's changed, then.

(Also, in a theoretical case, I wouldn't reasonably be able to use their model to find my own vulnerabilities before an attacker does, because they're far more invested and motivated to bypass those censors than I would be.)

Opus 4.6 uncovers 500 zero-day flaws in open-source code

Related Stories