Claude Opus 4.6 autonomously finds 500+ previously unknown zero-day vulnerabilities

Anthropic’s Frontier Red Team reported that Claude Opus 4.6, operating in a sandboxed environment with standard analysis tools but no task-specific instructions or custom scaffolding, found and validated more than 500 previously unknown high-severity vulnerabilities in widely used open-source software. Named examples included flaws in Ghostscript, a PostScript and PDF processor; OpenSC, a smart-card utility; and CGIF, a GIF file library — all libraries embedded across enterprise systems, developer tools and operating environments.

Anthropic described the model’s method as closer to how a human security researcher works than to the fuzzing-based tools that have dominated automated vulnerability discovery: it read git commit histories for security-relevant changes, identified unsafe coding patterns such as repeated unchecked string concatenation, and reasoned conceptually about algorithm behaviour — for instance the internal logic of LZW compression — to spot where it could fail. Every finding went through extensive human validation before disclosure: memory-corruption bugs were checked for reproducible crashes using address sanitizers, Claude itself was used to critique and deduplicate its own findings, and Anthropic security researchers, later joined by outside researchers as volume grew, confirmed each vulnerability and wrote patches, with some fixes already landing in affected projects by publication.

Anthropic framed the scale of the discovery as both a defensive capability and a disclosure-process problem: the report argued that existing coordinated-disclosure norms, including standard 90-day windows before public release, may not hold up against the speed and volume at which a capable model can now surface new vulnerabilities. The company introduced new cybersecurity-specific detection probes alongside the release, treating the same underlying capability as a tool that could as easily be turned to offence as to defence.