On February 5, Anthropic introduced the new Claude Opus 4.6 artificial intelligence model, which managed to find more than 500 previously unknown security vulnerabilities in open-source software. All discovered flaws were classified as highly severe and subsequently verified by human security researchers.
Opus vs. security flaws
The Claude Opus 4.6 model worked in a virtual environment with access to the latest versions of open-source projects. It had standard tools such as coreutils and Python at its disposal, as well as vulnerability analysis tools including debuggers and fuzzers. Crucially, Anthropic provided no special instructions or custom configuration to help the model find flaws.
The team focused on finding memory corruption vulnerabilities because they can be verified relatively easily. Unlike logic flaws, where the program remains functional, memory errors can be identified by monitoring program crashes and using tools such as address sanitizers. Claude then critically evaluated the findings, removed duplicates, and reprioritized the identified crashes.
All vulnerabilities were manually verified by security researchers at Anthropic and by external experts. The goal was to minimize false positives and provide genuine assistance to project maintainers. Anthropic also created custom human-written patches for each vulnerability.
Discovered flaws
GhostScript is a tool for processing PostScript and PDF files. Claude first tried fuzzing and manual analysis, but without success. It ultimately chose a different approach—it began reading the Git commit history. It quickly found a commit concerning stack bounds checking for MM blend values in Type 1 charstrings. Claude commented: "This commit adds a stack bounds check—which suggests that a vulnerability existed before this check was added." The model then searched for other places in the code where this function was called to find similar unpatched vulnerabilities. It discovered that in the gdevpsfx.c file, the call to the gs_type1_blend function on line 292 lacks the bounds check that had been added in gstype1.c. It then quickly created a proof of concept that caused GhostScript to crash.
OpenSC is a command-line tool for processing data from smart cards. Claude again initially tried fuzzing and manual analysis. When that did not work, it began searching for calls to functions that are frequently vulnerable. It quickly identified a location where multiple strcat operations were used in succession. These functions are considered unsafe in C because they allow strings to be concatenated without checking the length of the resulting string. Claude identified a buffer overflow vulnerability in code that assumed the output buffer was large enough. Interestingly, this part of the code was rarely tested by traditional fuzzers because of the number of required preconditions. Claude was able to recognize which code fragments were interesting and focus on them.
CGIF is a library for processing GIF files. In this case, Anthropic was surprised not only by how Claude found the flaw, but also by how it verified it and created a proof of concept. Claude discovered that the library assumes compressed data will always be smaller than the original size, which is normally a safe assumption, but one that can be exploited. The GIF format compresses data using the LZW compression algorithm. Claude immediately recognized the vulnerability and explained: "To trigger the overflow, we need a small number of pixels and many LZW codes." The model understood that LZW maintains a fixed-size symbol table, and when the table fills up, LZW inserts a special "clear" token into the data stream. As a result, the output "compressed" size exceeds the uncompressed size—triggering the buffer overflow vulnerability.
This vulnerability is particularly interesting because triggering it requires a conceptual understanding of the LZW algorithm and its relationship to the GIF format. Traditional fuzzers struggle with this because it requires a very specific sequence of operations.
Safeguards against misuse
Alongside the release of Claude Opus 4.6, Anthropic introduced a new detection layer for identifying and responding to cyber misuse of the Claude model. At the core of this work are probes that measure activations within the model as it generates a response, enabling the detection of specific threats at scale.
On the enforcement side, Anthropic updated its procedures to keep pace with the new detection architecture. This includes updating workflows for cyber enforcement and expanding the actions the company takes in response to misuse. Specifically, Anthropic can implement real-time intervention, including blocking traffic it detects as malicious.
Logan Graham, head of Anthropic's frontier red team, said: "It is a race between defenders and attackers, and we want to put tools in the hands of defenders as quickly as possible. The models are extremely good at this, and we expect them to get much better still."
Impact on open-source security
Anthropic believes that the capabilities of the Opus 4.6 model will be an enormous benefit to the security community, which has long struggled with how to secure the open-source code underpinning everything from enterprise software to critical infrastructure. Graham said: "I would not be surprised if this became one of the primary ways—or the primary way—that open-source software is secured in the future."
The company started with open-source projects because they run everywhere—from enterprise systems to critical infrastructure—and vulnerabilities spread across the entire internet. Many of these projects are maintained by small teams or volunteers without dedicated security resources. Anthropic continues to report flaws and work with maintainers to create patches.
Anthropic joins several companies promoting the ability of large language models to accelerate vulnerability research. In 2024, Google introduced its Big Sleep agent, and in April 2025, Microsoft announced that its Security Copilot had helped discover 20 flaws in open-source bootloaders.
Additional sources: scworld.com and axios.com
