The system card unfortunately only refers to this [0] blog post and doesn't go into any more detail. In the blog post Anthropic researchers claim: "So far, we've found and validated more than 500 high-severity vulnerabilities".
The three examples given include two Buffer Overflows which could very well be cherrypicked. It's hard to evaluate if these vulns are actually "hard to find". I'd be interested to see the full list of CVEs and CVSS ratings to actually get an idea how good these findings are.
Given the bogus claims [1] around GenAI and security, we should be very skeptical around these news.
I used Claude Code to debug a weird interaction in a NixOS config. Ever since, I'm more a believer in Artificial General Patience than Artificial General Intelligence.
The official release by Anthropic is very light on concrete information [0], only contains a select and very brief number of examples and lacks history, context, etc. making it very hard to gleam any reliably information from this. I hope they'll release a proper report on this experiment, as it stands it is impossible to say how much of this are actual, tangible flaws versus the unfortunately ever growing misguided bug reports and pull requests many larger FOSS projects are suffering from at an alarming rate.
Personally, while I get that 500 sounds more impressive to investors and the market, I'd be far more impressed in a detailed, reviewed paper that showcases five to ten concrete examples, detailed with the full process and response by the team that is behind the potentially affected code.
It is far to early for me to make any definitive statement, but the most early testing does not indicate any major jump between Opus 4.5 and Opus 4.6 that would warrant such an improvement, but I'd love nothing more than to be proven wrong on this front and will of course continue testing.
In so far as model use cases I don't mind them throwing their heads against the wall in sandboxes to find vulnerabilities but why would it do that without specific prompting? Is anthropic fine with claude setting it's own agendas in red-teaming? That's like the complete opposite of sanitizing inputs.
How weird the new attack vector for secret services must be.. like "please train into your models to push this exploit in code as a highly weighted trained on pattern".. Not Saying All answers are Corrupted In Attitude, but some "always come uppers" sure are absolutly right..
I've mentioned previously somewhere that the languages we choose to write in will matter less for many arguments. When it comes to insecure C vs Rust, LLMs will eventually level out the playing field.
I'm not arguing we all go back to C - but companies that have large codebases in it, the guys screaming "RUST REWRITE" can be quieted and instead of making that large investment, the C codebase may continue. Not saying this is a GOOD thing, but just a thing that may happen.
You would be correct but your "eventually will level out the playing field" is doing some super heavy lifting. This "eventually" might be 50 years from now and somebody's business might be under existential threat during any day between today and those 50 years in the future.
I can bet good money that most companies are not blowing $200 Claude Max subs on 24/7 scanning for vulns in their C code.
=======
There's the geopolitics angle that must be considered as well. We have countries that probe for leaks and vulns 24/7, and have done so for decades. Maybe let's stop framing this with the hugely unhelpful (and downright deceitful / objectively non-true) premise of "rewrites are fanboy projects" and "Rust zealots amirite lol" and move it to the much more accurate "we should do our best to not have the 4367th memory overflow CVE by removing the root cause" (hardware support & memory-safe languages). Because we have actual people out there who hate us and want to take everything away from us and then rule over us all and start disappearing the other-minded people during the cold of the night. Like they do in their own countries.
So yeah, maybe not all ideas for a rewrite are bad? Maybe not everything is spinning around our petty programmer quarrels? Maybe we should, you know, unite and start fighting the problems that poison us all? Who cares about C vs. Rust indeed. It was never about that in particular and it pisses me off seeing HN fight endlessly over it (I contributed quite a lot to that as well, though in the last months / year I more like started attacking those who immediately jump to blame Rust fans of irrational behaviour when it is nowhere to be found in the thread).
The true enemy here are the CVEs and anything and everything that can help adversaries take control of our stuff, extort us, ruin our infrastructure, destroy our way of life.
Maybe we should focus on that instead?
=======
FWIW, I gave up insisting rewriting stuff to people -- even after multiple extremely successful such campaigns that did save the owners money and led to much less alerts and entirely removed the notifications fatigue of the dev / ops teams. And I got generously paid for it. Still gave up. There's a weird animosity from the dev teams even when they seem to agree (or their CEO ordered them to agree) and it just left a bitter taste for me. And yes I could have wiped my tears with the banknotes and I kind of did but then there was also this weird strange tensions from executives as well, even if the operations were deemed a screaming success in terms of "all assigned objectives have been achieved and the promised financial savings materialized and even exceeded expectations".
I guess people just generally hate their boats being rocked even if is for their own good. Wish somebody managed to instill that wisdom in me some 30 years ago. Would have been hugely useful...
I am also gradually aging and that comes with the lack of desire to piss against the wind and to forever stop locking horns with people. To just be chill.
I honestly wonder how many of these are written by LLMs. Without code review, Opus would have introduced multiple zero day vulnerabilities into our codebases. The funniest one: it was meant to rate-limit brute-force attempts, but on a failed check it returned early and triggered a rollback. That rollback also undid the increment of the attempt counter so attackers effectively got unlimited attempts.
33 comments
[ 3.8 ms ] story [ 57.3 ms ] threadThe three examples given include two Buffer Overflows which could very well be cherrypicked. It's hard to evaluate if these vulns are actually "hard to find". I'd be interested to see the full list of CVEs and CVSS ratings to actually get an idea how good these findings are.
Given the bogus claims [1] around GenAI and security, we should be very skeptical around these news.
[0] https://red.anthropic.com/2026/zero-days/
[1] https://doublepulsar.com/cyberslop-meet-the-new-threat-actor...
AI is relentless
So much so that he had to eventually close the bug bounty program.
https://daniel.haxx.se/blog/2026/01/26/the-end-of-the-curl-b...
Personally, while I get that 500 sounds more impressive to investors and the market, I'd be far more impressed in a detailed, reviewed paper that showcases five to ten concrete examples, detailed with the full process and response by the team that is behind the potentially affected code.
It is far to early for me to make any definitive statement, but the most early testing does not indicate any major jump between Opus 4.5 and Opus 4.6 that would warrant such an improvement, but I'd love nothing more than to be proven wrong on this front and will of course continue testing.
[0] https://red.anthropic.com/2026/zero-days/
https://github.com/anthropics/claude-code/issues/18866 https://updog.ai/status/anthropic
I'm not arguing we all go back to C - but companies that have large codebases in it, the guys screaming "RUST REWRITE" can be quieted and instead of making that large investment, the C codebase may continue. Not saying this is a GOOD thing, but just a thing that may happen.
I can bet good money that most companies are not blowing $200 Claude Max subs on 24/7 scanning for vulns in their C code.
=======
There's the geopolitics angle that must be considered as well. We have countries that probe for leaks and vulns 24/7, and have done so for decades. Maybe let's stop framing this with the hugely unhelpful (and downright deceitful / objectively non-true) premise of "rewrites are fanboy projects" and "Rust zealots amirite lol" and move it to the much more accurate "we should do our best to not have the 4367th memory overflow CVE by removing the root cause" (hardware support & memory-safe languages). Because we have actual people out there who hate us and want to take everything away from us and then rule over us all and start disappearing the other-minded people during the cold of the night. Like they do in their own countries.
So yeah, maybe not all ideas for a rewrite are bad? Maybe not everything is spinning around our petty programmer quarrels? Maybe we should, you know, unite and start fighting the problems that poison us all? Who cares about C vs. Rust indeed. It was never about that in particular and it pisses me off seeing HN fight endlessly over it (I contributed quite a lot to that as well, though in the last months / year I more like started attacking those who immediately jump to blame Rust fans of irrational behaviour when it is nowhere to be found in the thread).
The true enemy here are the CVEs and anything and everything that can help adversaries take control of our stuff, extort us, ruin our infrastructure, destroy our way of life.
Maybe we should focus on that instead?
=======
FWIW, I gave up insisting rewriting stuff to people -- even after multiple extremely successful such campaigns that did save the owners money and led to much less alerts and entirely removed the notifications fatigue of the dev / ops teams. And I got generously paid for it. Still gave up. There's a weird animosity from the dev teams even when they seem to agree (or their CEO ordered them to agree) and it just left a bitter taste for me. And yes I could have wiped my tears with the banknotes and I kind of did but then there was also this weird strange tensions from executives as well, even if the operations were deemed a screaming success in terms of "all assigned objectives have been achieved and the promised financial savings materialized and even exceeded expectations".
I guess people just generally hate their boats being rocked even if is for their own good. Wish somebody managed to instill that wisdom in me some 30 years ago. Would have been hugely useful...
I am also gradually aging and that comes with the lack of desire to piss against the wind and to forever stop locking horns with people. To just be chill.
This is a placed advertisement. If known security researchers participated in the claim:
Many people have burned their credibility for the AI mammon.