{"id":"84c70b1e9cb8b4fd997f435fa6d196b08d4ff7bb917f00408a5d0139320fb34f","title":"Anthropic says Claude found and exploited vulnerabilities in widely used software","argument":"Anthropic reports that an unreleased internal research model found vulnerabilities in browsers, operating systems, Android, and Linux, then combined some into working exploits. The company describes five attack chains, including remote code execution in Chrome and Linux, a Safari data-access exploit, an Android lock-screen bypass, and a Windows remote denial of service. It says the findings were reported to the affected vendors, and describes fixes or patches for the vulnerabilities discussed.\n\nAnthropic says its approach used many scanning agents in parallel, varied scanning strategies, and a verification and risk-rating process. It argues that test-time compute scaling and scanner diversity increased the number of vulnerabilities found, and recommends scanning code when changes are proposed. As an Escape Meridian interpretation, the account suggests that models may help security teams find and verify vulnerabilities, while also raising the stakes of who can produce working exploits. Anthropic does not report a comparison showing how often this approach finds vulnerabilities relative to other methods, or how well it works across software beyond the examples described.\n\nAn open question is whether scanning at PR time can reduce the rate of new vulnerabilities entering software in practice.","topicIds":["intelligence-and-discovery","work-and-agency","institutions-and-trust"],"domain":"work","claimType":"attributed reading","limits":"The findings and account come from Anthropic's own research; the post does not provide an independent evaluation or comparison with other vulnerability-finding methods. The model was described as an unreleased internal research model, and the post does not establish how well the results generalize beyond the examples discussed. The post describes fixes or patches for the reported vulnerabilities but does not establish the deployment status of every fix across affected systems.","speaker":{"name":"Anthropic","roleAtSource":"Article author"},"source":{"title":"Discovering and exploiting vulnerabilities in critical, real-world software with Claude","publisher":"Anthropic","format":"Article","url":"https://www.anthropic.com/research/discovering-vulnerabilities-with-claude","publishedAt":"2026-10-27T00:00:00.000Z","dateBasis":"Date stated by the publisher."},"evidence":[{"text":"Anthropic says an unreleased internal research model found vulnerabilities in widely used software and created five exploit chains.","excerpt":"we’ve used an unreleased, internal research model to find critical vulnerabilities in some of the world’s most widely used software","url":"https://www.anthropic.com/research/discovering-vulnerabilities-with-claude","relationship":"Source-stated"},{"text":"Anthropic describes exploit chains affecting Chrome, Safari, Android, Windows, and Linux, with impacts including remote code execution, data access, lock-screen bypass, and denial of service.","excerpt":"In this post, we share details of five attack chains, which led to remote code execution and other critical impacts with little to no user interaction.","url":"https://www.anthropic.com/research/discovering-vulnerabilities-with-claude","relationship":"Source-stated"},{"text":"Anthropic says the vulnerabilities were reported to affected vendors and describes fixes or patches for the vulnerabilities in the examples.","excerpt":"We reported each vulnerability to the affected vendor under our coordinated vulnerability disclosure","url":"https://www.anthropic.com/research/discovering-vulnerabilities-with-claude","relationship":"Source-stated"},{"text":"Anthropic says it used parallel scanning agents, different scanning strategies, and a standardized verification and risk-rating process.","excerpt":"We built a platform that runs large numbers of scanning agents in parallel","url":"https://www.anthropic.com/research/discovering-vulnerabilities-with-claude","relationship":"Source-stated"},{"text":"Anthropic recommends scanning code at PR time to help reduce the entry of new vulnerabilities.","excerpt":"For that, we recommend scanning at PR time.","url":"https://www.anthropic.com/research/discovering-vulnerabilities-with-claude","relationship":"Source-stated"},{"text":"The examples suggest models may help security teams find vulnerabilities, while also making working exploits easier to produce; the broader effects are not established by this account.","excerpt":"Frontier models have the ability to discover and combine multiple vulnerabilities into a working exploit.","url":"https://www.anthropic.com/research/discovering-vulnerabilities-with-claude","relationship":"Escape Meridian interpretation"}],"sourceMedia":{"status":"found","sourceUrl":"https://www.anthropic.com/research/discovering-vulnerabilities-with-claude","checkedAt":"2026-10-29T16:17:54.627Z","items":[{"type":"image","url":"https://www-cdn.anthropic.com/images/4zrzovbb/website/6d4a0d28992ade92d6fa63646fd9c9d318245c6c-2400x1260.jpg","sourceUrl":"https://www.anthropic.com/research/discovering-vulnerabilities-with-claude","attribution":"Anthropic","basis":"publisher-metadata","availability":"verified","label":"Anthropic logo","verifiedAt":"2026-10-29T16:17:54.978Z"}],"note":"Media declared by the original publisher; availability checked separately from the editorial reading."},"assumptions":[],"openQuestion":{"attribution":"Open question","text":"Does scanning at PR time reduce the rate of new vulnerabilities entering software, and how would that effect be measured?"},"whatWouldChangeView":{"attribution":"Change condition not recorded","text":""},"editorialComparisons":[],"live":{"title":"Anthropic says Claude found and exploited vulnerabilities in widely used software","summary":"Anthropic reports that an unreleased internal research model found vulnerabilities in browsers, operating systems, Android, and Linux, then combined some into working exploits. The company describes five attack chains, including remote code execution in Chrome and Linux, a Safari data-access exploit, an Android lock-screen bypass, and a Windows remote denial of service. It says the findings were reported to the affected vendors, and describes fixes or patches for the vulnerabilities discussed.\n\nAnthropic says its approach used many scanning agents in parallel, varied scanning strategies, and a verification and risk-rating process. It argues that test-time compute scaling and scanner diversity increased the number of vulnerabilities found, and recommends scanning code when changes are proposed. As an Escape Meridian interpretation, the account suggests that models may help security teams find and verify vulnerabilities, while also raising the stakes of who can produce working exploits. Anthropic does not report a comparison showing how often this approach finds vulnerabilities relative to other methods, or how well it works across software beyond the examples described.\n\nAn open question is whether scanning at PR time can reduce the rate of new vulnerabilities entering software in practice.","question":"Does scanning at PR time reduce the rate of new vulnerabilities entering software, and how would that effect be measured?","claims":[{"text":"Anthropic says an unreleased internal research model found vulnerabilities in widely used software and created five exploit chains.","excerpt":"we’ve used an unreleased, internal research model to find critical vulnerabilities in some of the world’s most widely used software","support":"source-stated"},{"text":"Anthropic describes exploit chains affecting Chrome, Safari, Android, Windows, and Linux, with impacts including remote code execution, data access, lock-screen bypass, and denial of service.","excerpt":"In this post, we share details of five attack chains, which led to remote code execution and other critical impacts with little to no user interaction.","support":"source-stated"},{"text":"Anthropic says the vulnerabilities were reported to affected vendors and describes fixes or patches for the vulnerabilities in the examples.","excerpt":"We reported each vulnerability to the affected vendor under our coordinated vulnerability disclosure","support":"source-stated"},{"text":"Anthropic says it used parallel scanning agents, different scanning strategies, and a standardized verification and risk-rating process.","excerpt":"We built a platform that runs large numbers of scanning agents in parallel","support":"source-stated"},{"text":"Anthropic recommends scanning code at PR time to help reduce the entry of new vulnerabilities.","excerpt":"For that, we recommend scanning at PR time.","support":"source-stated"},{"text":"The examples suggest models may help security teams find vulnerabilities, while also making working exploits easier to produce; the broader effects are not established by this account.","excerpt":"Frontier models have the ability to discover and combine multiple vulnerabilities into a working exploit.","support":"interpretation"}],"limitations":["The findings and account come from Anthropic's own research; the post does not provide an independent evaluation or comparison with other vulnerability-finding methods.","The model was described as an unreleased internal research model, and the post does not establish how well the results generalize beyond the examples discussed.","The post describes fixes or patches for the reported vulnerabilities but does not establish the deployment status of every fix across affected systems."],"mediaId":"2ef1fbc3458e029d755f0754946b16c2abbfaca7f20927ba921e8903dea6efae","correctionReason":null,"id":"84c70b1e9cb8b4fd997f435fa6d196b08d4ff7bb917f00408a5d0139320fb34f","publicationId":"c6b67fe8-3665-424e-81fd-82b39fdc6ac4","version":1,"sourceUrl":"https://www.anthropic.com/research/discovering-vulnerabilities-with-claude","sourceTitle":"Discovering and exploiting vulnerabilities in critical, real-world software with Claude","publisher":"Anthropic","publishedAt":"2026-10-27T00:00:00.000Z","originalPublished":{"value":"2026-10-27T00:00:00.000Z","precision":"instant","basis":"publisher_page"},"firstObservedAt":"2026-10-27T18:23:20.708Z","createdAt":"2026-11-07T01:16:46.644Z","historical":true,"entityIds":["anthropic"],"topicIds":["intelligence-and-discovery","work-and-agency","institutions-and-trust"],"media":[{"id":"2ef1fbc3458e029d755f0754946b16c2abbfaca7f20927ba921e8903dea6efae","kind":"article","url":"https://www.anthropic.com/research/discovering-vulnerabilities-with-claude","sourceUrl":"https://www.anthropic.com/research/discovering-vulnerabilities-with-claude","label":"Read original","provenance":"source_link","verification":{"status":"verified","checkedAt":"2026-10-29T16:17:54.978Z","method":"acquired_source","contentType":"text/html"},"recommendationReason":"Recommended by Jev for understanding this source; checked by Luna."},{"id":"4a48f445d46dc62c1288e46535524e9babc1c37539ef87bb172ed3dd0d87c565","kind":"image","url":"https://www-cdn.anthropic.com/images/4zrzovbb/website/6d4a0d28992ade92d6fa63646fd9c9d318245c6c-2400x1260.jpg","sourceUrl":"https://www.anthropic.com/research/discovering-vulnerabilities-with-claude","label":"Anthropic logo","provenance":"publisher_page","verification":{"status":"verified","checkedAt":"2026-10-29T16:17:54.978Z","method":"publisher_association_and_head","contentType":"image/jpeg","cacheUntil":1793290974978},"recommendationReason":"Observed on the acquired publisher source; availability checked."}],"sourceMedia":{"status":"found","sourceUrl":"https://www.anthropic.com/research/discovering-vulnerabilities-with-claude","checkedAt":"2026-10-29T16:17:54.627Z","items":[{"type":"image","url":"https://www-cdn.anthropic.com/images/4zrzovbb/website/6d4a0d28992ade92d6fa63646fd9c9d318245c6c-2400x1260.jpg","sourceUrl":"https://www.anthropic.com/research/discovering-vulnerabilities-with-claude","attribution":"Anthropic","basis":"publisher-metadata","availability":"verified","label":"Anthropic logo","verifiedAt":"2026-10-29T16:17:54.978Z"}],"note":"Media declared by the original publisher; availability checked separately from the editorial reading."},"editorialDecision":{"outcome":"accept","reasonCodes":["material_development"],"rubricVersion":"stream-admission-v5","mediaId":"2ef1fbc3458e029d755f0754946b16c2abbfaca7f20927ba921e8903dea6efae","confidence":0.97,"provider":"typesafe","model":"jev-1.13.0","inputHash":"478a385c282c07e45324e6cc2c6e52f626efca61092870ae9074956856f098ee","decidedAt":"2026-10-29T16:17:57.182Z"},"provenance":{"textHash":"43027fc0b5d5e040e96393e45e9a07715382afce424a104c81d84a81d17a68f9","observationId":"5c60226391a23631c7fef9db1846da42bab316fe4d36f69b579a9a054644c83f","retrievedAt":"2026-10-29T16:17:54.627Z","kind":"publisher-page","preparer":{"model":"gpt-6-luna","runId":"c9b23fc2-73fb-46af-88c8-5d6833c2b430"},"reviewer":{"model":"gpt-6-luna","runId":"ffa924fd-dfc7-4c20-8d8e-cbc83647cfa5"}},"audit":{"status":"uncertain","reviewedAt":"2026-11-07T01:16:46.644Z","model":"anthropic/claude-opus-5.5"},"sourceAttribution":{"authors":[{"name":"Anthropic","url":"https://www.anthropic.com/","kind":"Organization"}],"authorRole":"article-author","hosts":[],"status":"stated","authorRoster":{"truncated":false,"omitted":0,"assertionGroupsOmitted":0},"participation":[{"actor":{"name":"Anthropic","url":"https://www.anthropic.com/","kind":"Organization","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Anthropic","status":"stated","provenance":{"basis":"article-jsonld","sourceUrl":"https://www.anthropic.com/research/discovering-vulnerabilities-with-claude","locator":"document/html[1]/body[1]/main[4]/script[0]@23307.author"},"assertionId":"4fe1a2649d532e3659c5e2ba1fbee0f83a659392580807df6aef615c6ac9013d:participation:0","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-10-29T16:17:54.627Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"4fe1a2649d532e3659c5e2ba1fbee0f83a659392580807df6aef615c6ac9013d","sourceUrl":"https://www.anthropic.com/research/discovering-vulnerabilities-with-claude","contentSha256":"d7835b78f66b4f2b18a995660c2f1f107eda76a4589d99b68767402b1deec63f","textHash":"43027fc0b5d5e040e96393e45e9a07715382afce424a104c81d84a81d17a68f9","observedAt":"2026-10-29T16:17:54.627Z"}},{"actor":{"name":"Anthropic","url":"https://www.anthropic.com/","kind":"unknown","actorId":null},"role":"publisher","scope":{"kind":"publication","locator":null},"literalCredit":"Anthropic","status":"stated","provenance":{"basis":"article-publisher","sourceUrl":"https://www.anthropic.com/research/discovering-vulnerabilities-with-claude","locator":"document/html[1]/body[1]/main[4]/script[0]@23307.publisher"},"assertionId":"4fe1a2649d532e3659c5e2ba1fbee0f83a659392580807df6aef615c6ac9013d:participation:1","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-10-29T16:17:54.627Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"4fe1a2649d532e3659c5e2ba1fbee0f83a659392580807df6aef615c6ac9013d","sourceUrl":"https://www.anthropic.com/research/discovering-vulnerabilities-with-claude","contentSha256":"d7835b78f66b4f2b18a995660c2f1f107eda76a4589d99b68767402b1deec63f","textHash":"43027fc0b5d5e040e96393e45e9a07715382afce424a104c81d84a81d17a68f9","observedAt":"2026-10-29T16:17:54.627Z"}}],"participationCoverage":{"total":2,"returned":2,"complete":true,"fullAssertions":"source-metadata-endpoint"},"distribution":null,"publisher":{"name":"Anthropic","url":"https://www.anthropic.com/"},"sourceUrl":"https://www.anthropic.com/research/discovering-vulnerabilities-with-claude","snapshotId":"4fe1a2649d532e3659c5e2ba1fbee0f83a659392580807df6aef615c6ac9013d","contentSha256":"d7835b78f66b4f2b18a995660c2f1f107eda76a4589d99b68767402b1deec63f","textHash":"43027fc0b5d5e040e96393e45e9a07715382afce424a104c81d84a81d17a68f9","observedAt":"2026-10-29T16:17:54.627Z","basis":"publisher-page-metadata","sourceLinks":8,"linksTruncated":false,"metadataUrl":"/api/pipeline/stream/84c70b1e9cb8b4fd997f435fa6d196b08d4ff7bb917f00408a5d0139320fb34f/source"}},"canonicalUrl":"https://escapemeridian.com/readings/anthropic-says-claude-found-and-exploited-vulnerabilities-in-84c70b1e","formats":{"html":"/readings/anthropic-says-claude-found-and-exploited-vulnerabilities-in-84c70b1e","markdown":"/readings/anthropic-says-claude-found-and-exploited-vulnerabilities-in-84c70b1e.md","json":"/readings/anthropic-says-claude-found-and-exploited-vulnerabilities-in-84c70b1e.json"},"attribution":"Headline and summary by Escape Meridian, prepared by Luna from the attributed source. A source check is not independent confirmation of the source’s claims.","maintainedGuideLinks":[],"readerContext":{"version":"reader-context-v1","attribution":"Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement.","terms":[{"id":"term-test-time-compute","name":"Test-time compute","explanation":"Extra computation a model spends while answering, for example by reasoning longer, rather than during training.","referenceUrl":"https://arxiv.org/abs/2408.03314"}],"entities":[{"id":"anthropic","name":"Anthropic","kind":"organization","context":"Anthropic develops Claude and publishes research about AI capability, safety and how people use its systems.","referenceUrls":["https://www.anthropic.com/news","https://www.anthropic.com/research/team/economics"],"path":"/entities/anthropic","json":"/entities/anthropic.json","markdown":"/entities/anthropic.md"},{"id":"claude","name":"Claude","kind":"model","context":"Claude is Anthropic’s family of AI models and assistants for tasks such as writing, analysis and coding.","referenceUrls":["https://claude.com/product/overview","https://www.anthropic.com/news","https://www.anthropic.com/research/team/economics"],"path":"/entities/claude","json":"/entities/claude.json","markdown":"/entities/claude.md"},{"id":"time","name":"TIME","kind":"organization","context":"TIME is a news magazine publishing reporting on world affairs, business, technology and the workers behind digital services.","referenceUrls":["https://time.com/"],"path":"/entities/time","json":"/entities/time.json","markdown":"/entities/time.md"}]},"researchQuestions":[],"withdrawn":false,"references":{"schemaVersion":1,"target":{"type":"reading","id":"84c70b1e9cb8b4fd997f435fa6d196b08d4ff7bb917f00408a5d0139320fb34f","revision":"c6b67fe8-3665-424e-81fd-82b39fdc6ac4","revisionKind":"publication-id","title":"Anthropic says Claude found and exploited vulnerabilities in widely used software","url":"https://escapemeridian.com/readings/anthropic-says-claude-found-and-exploited-vulnerabilities-in-84c70b1e"},"source":{"type":"source","id":"https://www.anthropic.com/research/discovering-vulnerabilities-with-claude","revision":"43027fc0b5d5e040e96393e45e9a07715382afce424a104c81d84a81d17a68f9","revisionKind":"sha256-source-text","title":"Discovering and exploiting vulnerabilities in critical, real-world software with Claude","url":"https://www.anthropic.com/research/discovering-vulnerabilities-with-claude"},"status":"available","items":[],"next":null,"scope":"Explicit citations in public readings and public file attachments to this reading. Shared topics are not citations. Other artifact types need an explicit reference adapter."},"revisions":[{"id":"84c70b1e9cb8b4fd997f435fa6d196b08d4ff7bb917f00408a5d0139320fb34f","title":"Anthropic says Claude found and exploited vulnerabilities in widely used software","argument":"Anthropic reports that an unreleased internal research model found vulnerabilities in browsers, operating systems, Android, and Linux, then combined some into working exploits. The company describes five attack chains, including remote code execution in Chrome and Linux, a Safari data-access exploit, an Android lock-screen bypass, and a Windows remote denial of service. It says the findings were reported to the affected vendors, and describes fixes or patches for the vulnerabilities discussed.\n\nAnthropic says its approach used many scanning agents in parallel, varied scanning strategies, and a verification and risk-rating process. It argues that test-time compute scaling and scanner diversity increased the number of vulnerabilities found, and recommends scanning code when changes are proposed. As an Escape Meridian interpretation, the account suggests that models may help security teams find and verify vulnerabilities, while also raising the stakes of who can produce working exploits. Anthropic does not report a comparison showing how often this approach finds vulnerabilities relative to other methods, or how well it works across software beyond the examples described.\n\nAn open question is whether scanning at PR time can reduce the rate of new vulnerabilities entering software in practice.","topicIds":["intelligence-and-discovery","work-and-agency","institutions-and-trust"],"domain":"work","claimType":"attributed reading","limits":"The findings and account come from Anthropic's own research; the post does not provide an independent evaluation or comparison with other vulnerability-finding methods. The model was described as an unreleased internal research model, and the post does not establish how well the results generalize beyond the examples discussed. The post describes fixes or patches for the reported vulnerabilities but does not establish the deployment status of every fix across affected systems.","speaker":{"name":"Anthropic","roleAtSource":"Article author"},"source":{"title":"Discovering and exploiting vulnerabilities in critical, real-world software with Claude","publisher":"Anthropic","format":"Article","url":"https://www.anthropic.com/research/discovering-vulnerabilities-with-claude","publishedAt":"2026-10-27T00:00:00.000Z","dateBasis":"Date stated by the publisher."},"evidence":[{"text":"Anthropic says an unreleased internal research model found vulnerabilities in widely used software and created five exploit chains.","excerpt":"we’ve used an unreleased, internal research model to find critical vulnerabilities in some of the world’s most widely used software","url":"https://www.anthropic.com/research/discovering-vulnerabilities-with-claude","relationship":"Source-stated"},{"text":"Anthropic describes exploit chains affecting Chrome, Safari, Android, Windows, and Linux, with impacts including remote code execution, data access, lock-screen bypass, and denial of service.","excerpt":"In this post, we share details of five attack chains, which led to remote code execution and other critical impacts with little to no user interaction.","url":"https://www.anthropic.com/research/discovering-vulnerabilities-with-claude","relationship":"Source-stated"},{"text":"Anthropic says the vulnerabilities were reported to affected vendors and describes fixes or patches for the vulnerabilities in the examples.","excerpt":"We reported each vulnerability to the affected vendor under our coordinated vulnerability disclosure","url":"https://www.anthropic.com/research/discovering-vulnerabilities-with-claude","relationship":"Source-stated"},{"text":"Anthropic says it used parallel scanning agents, different scanning strategies, and a standardized verification and risk-rating process.","excerpt":"We built a platform that runs large numbers of scanning agents in parallel","url":"https://www.anthropic.com/research/discovering-vulnerabilities-with-claude","relationship":"Source-stated"},{"text":"Anthropic recommends scanning code at PR time to help reduce the entry of new vulnerabilities.","excerpt":"For that, we recommend scanning at PR time.","url":"https://www.anthropic.com/research/discovering-vulnerabilities-with-claude","relationship":"Source-stated"},{"text":"The examples suggest models may help security teams find vulnerabilities, while also making working exploits easier to produce; the broader effects are not established by this account.","excerpt":"Frontier models have the ability to discover and combine multiple vulnerabilities into a working exploit.","url":"https://www.anthropic.com/research/discovering-vulnerabilities-with-claude","relationship":"Escape Meridian interpretation"}],"sourceMedia":{"status":"found","sourceUrl":"https://www.anthropic.com/research/discovering-vulnerabilities-with-claude","checkedAt":"2026-10-29T16:17:54.627Z","items":[{"type":"image","url":"https://www-cdn.anthropic.com/images/4zrzovbb/website/6d4a0d28992ade92d6fa63646fd9c9d318245c6c-2400x1260.jpg","sourceUrl":"https://www.anthropic.com/research/discovering-vulnerabilities-with-claude","attribution":"Anthropic","basis":"publisher-metadata","availability":"verified","label":"Anthropic logo","verifiedAt":"2026-10-29T16:17:54.978Z"}],"note":"Media declared by the original publisher; availability checked separately from the editorial reading."},"assumptions":[],"openQuestion":{"attribution":"Open question","text":"Does scanning at PR time reduce the rate of new vulnerabilities entering software, and how would that effect be measured?"},"whatWouldChangeView":{"attribution":"Change condition not recorded","text":""},"editorialComparisons":[],"live":{"title":"Anthropic says Claude found and exploited vulnerabilities in widely used software","summary":"Anthropic reports that an unreleased internal research model found vulnerabilities in browsers, operating systems, Android, and Linux, then combined some into working exploits. The company describes five attack chains, including remote code execution in Chrome and Linux, a Safari data-access exploit, an Android lock-screen bypass, and a Windows remote denial of service. It says the findings were reported to the affected vendors, and describes fixes or patches for the vulnerabilities discussed.\n\nAnthropic says its approach used many scanning agents in parallel, varied scanning strategies, and a verification and risk-rating process. It argues that test-time compute scaling and scanner diversity increased the number of vulnerabilities found, and recommends scanning code when changes are proposed. As an Escape Meridian interpretation, the account suggests that models may help security teams find and verify vulnerabilities, while also raising the stakes of who can produce working exploits. Anthropic does not report a comparison showing how often this approach finds vulnerabilities relative to other methods, or how well it works across software beyond the examples described.\n\nAn open question is whether scanning at PR time can reduce the rate of new vulnerabilities entering software in practice.","question":"Does scanning at PR time reduce the rate of new vulnerabilities entering software, and how would that effect be measured?","claims":[{"text":"Anthropic says an unreleased internal research model found vulnerabilities in widely used software and created five exploit chains.","excerpt":"we’ve used an unreleased, internal research model to find critical vulnerabilities in some of the world’s most widely used software","support":"source-stated"},{"text":"Anthropic describes exploit chains affecting Chrome, Safari, Android, Windows, and Linux, with impacts including remote code execution, data access, lock-screen bypass, and denial of service.","excerpt":"In this post, we share details of five attack chains, which led to remote code execution and other critical impacts with little to no user interaction.","support":"source-stated"},{"text":"Anthropic says the vulnerabilities were reported to affected vendors and describes fixes or patches for the vulnerabilities in the examples.","excerpt":"We reported each vulnerability to the affected vendor under our coordinated vulnerability disclosure","support":"source-stated"},{"text":"Anthropic says it used parallel scanning agents, different scanning strategies, and a standardized verification and risk-rating process.","excerpt":"We built a platform that runs large numbers of scanning agents in parallel","support":"source-stated"},{"text":"Anthropic recommends scanning code at PR time to help reduce the entry of new vulnerabilities.","excerpt":"For that, we recommend scanning at PR time.","support":"source-stated"},{"text":"The examples suggest models may help security teams find vulnerabilities, while also making working exploits easier to produce; the broader effects are not established by this account.","excerpt":"Frontier models have the ability to discover and combine multiple vulnerabilities into a working exploit.","support":"interpretation"}],"limitations":["The findings and account come from Anthropic's own research; the post does not provide an independent evaluation or comparison with other vulnerability-finding methods.","The model was described as an unreleased internal research model, and the post does not establish how well the results generalize beyond the examples discussed.","The post describes fixes or patches for the reported vulnerabilities but does not establish the deployment status of every fix across affected systems."],"mediaId":"2ef1fbc3458e029d755f0754946b16c2abbfaca7f20927ba921e8903dea6efae","correctionReason":null,"id":"84c70b1e9cb8b4fd997f435fa6d196b08d4ff7bb917f00408a5d0139320fb34f","publicationId":"c6b67fe8-3665-424e-81fd-82b39fdc6ac4","version":1,"sourceUrl":"https://www.anthropic.com/research/discovering-vulnerabilities-with-claude","sourceTitle":"Discovering and exploiting vulnerabilities in critical, real-world software with Claude","publisher":"Anthropic","publishedAt":"2026-10-27T00:00:00.000Z","originalPublished":{"value":"2026-10-27T00:00:00.000Z","precision":"instant","basis":"publisher_page"},"firstObservedAt":"2026-10-27T18:23:20.708Z","createdAt":"2026-11-07T01:16:46.644Z","historical":true,"entityIds":["anthropic"],"topicIds":["intelligence-and-discovery","work-and-agency","institutions-and-trust"],"media":[{"id":"2ef1fbc3458e029d755f0754946b16c2abbfaca7f20927ba921e8903dea6efae","kind":"article","url":"https://www.anthropic.com/research/discovering-vulnerabilities-with-claude","sourceUrl":"https://www.anthropic.com/research/discovering-vulnerabilities-with-claude","label":"Read original","provenance":"source_link","verification":{"status":"verified","checkedAt":"2026-10-29T16:17:54.978Z","method":"acquired_source","contentType":"text/html"},"recommendationReason":"Recommended by Jev for understanding this source; checked by Luna."},{"id":"4a48f445d46dc62c1288e46535524e9babc1c37539ef87bb172ed3dd0d87c565","kind":"image","url":"https://www-cdn.anthropic.com/images/4zrzovbb/website/6d4a0d28992ade92d6fa63646fd9c9d318245c6c-2400x1260.jpg","sourceUrl":"https://www.anthropic.com/research/discovering-vulnerabilities-with-claude","label":"Anthropic logo","provenance":"publisher_page","verification":{"status":"verified","checkedAt":"2026-10-29T16:17:54.978Z","method":"publisher_association_and_head","contentType":"image/jpeg","cacheUntil":1793290974978},"recommendationReason":"Observed on the acquired publisher source; availability checked."}],"sourceMedia":{"status":"found","sourceUrl":"https://www.anthropic.com/research/discovering-vulnerabilities-with-claude","checkedAt":"2026-10-29T16:17:54.627Z","items":[{"type":"image","url":"https://www-cdn.anthropic.com/images/4zrzovbb/website/6d4a0d28992ade92d6fa63646fd9c9d318245c6c-2400x1260.jpg","sourceUrl":"https://www.anthropic.com/research/discovering-vulnerabilities-with-claude","attribution":"Anthropic","basis":"publisher-metadata","availability":"verified","label":"Anthropic logo","verifiedAt":"2026-10-29T16:17:54.978Z"}],"note":"Media declared by the original publisher; availability checked separately from the editorial reading."},"editorialDecision":{"outcome":"accept","reasonCodes":["material_development"],"rubricVersion":"stream-admission-v5","mediaId":"2ef1fbc3458e029d755f0754946b16c2abbfaca7f20927ba921e8903dea6efae","confidence":0.97,"provider":"typesafe","model":"jev-1.13.0","inputHash":"478a385c282c07e45324e6cc2c6e52f626efca61092870ae9074956856f098ee","decidedAt":"2026-10-29T16:17:57.182Z"},"provenance":{"textHash":"43027fc0b5d5e040e96393e45e9a07715382afce424a104c81d84a81d17a68f9","observationId":"5c60226391a23631c7fef9db1846da42bab316fe4d36f69b579a9a054644c83f","retrievedAt":"2026-10-29T16:17:54.627Z","kind":"publisher-page","preparer":{"model":"gpt-6-luna","runId":"c9b23fc2-73fb-46af-88c8-5d6833c2b430"},"reviewer":{"model":"gpt-6-luna","runId":"ffa924fd-dfc7-4c20-8d8e-cbc83647cfa5"}},"audit":{"status":"uncertain","reviewedAt":"2026-11-07T01:16:46.644Z","model":"anthropic/claude-opus-5.5"},"sourceAttribution":{"authors":[{"name":"Anthropic","url":"https://www.anthropic.com/","kind":"Organization"}],"authorRole":"article-author","hosts":[],"status":"stated","authorRoster":{"truncated":false,"omitted":0,"assertionGroupsOmitted":0},"participation":[{"actor":{"name":"Anthropic","url":"https://www.anthropic.com/","kind":"Organization","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Anthropic","status":"stated","provenance":{"basis":"article-jsonld","sourceUrl":"https://www.anthropic.com/research/discovering-vulnerabilities-with-claude","locator":"document/html[1]/body[1]/main[4]/script[0]@23307.author"},"assertionId":"4fe1a2649d532e3659c5e2ba1fbee0f83a659392580807df6aef615c6ac9013d:participation:0","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-10-29T16:17:54.627Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"4fe1a2649d532e3659c5e2ba1fbee0f83a659392580807df6aef615c6ac9013d","sourceUrl":"https://www.anthropic.com/research/discovering-vulnerabilities-with-claude","contentSha256":"d7835b78f66b4f2b18a995660c2f1f107eda76a4589d99b68767402b1deec63f","textHash":"43027fc0b5d5e040e96393e45e9a07715382afce424a104c81d84a81d17a68f9","observedAt":"2026-10-29T16:17:54.627Z"}},{"actor":{"name":"Anthropic","url":"https://www.anthropic.com/","kind":"unknown","actorId":null},"role":"publisher","scope":{"kind":"publication","locator":null},"literalCredit":"Anthropic","status":"stated","provenance":{"basis":"article-publisher","sourceUrl":"https://www.anthropic.com/research/discovering-vulnerabilities-with-claude","locator":"document/html[1]/body[1]/main[4]/script[0]@23307.publisher"},"assertionId":"4fe1a2649d532e3659c5e2ba1fbee0f83a659392580807df6aef615c6ac9013d:participation:1","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-10-29T16:17:54.627Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"4fe1a2649d532e3659c5e2ba1fbee0f83a659392580807df6aef615c6ac9013d","sourceUrl":"https://www.anthropic.com/research/discovering-vulnerabilities-with-claude","contentSha256":"d7835b78f66b4f2b18a995660c2f1f107eda76a4589d99b68767402b1deec63f","textHash":"43027fc0b5d5e040e96393e45e9a07715382afce424a104c81d84a81d17a68f9","observedAt":"2026-10-29T16:17:54.627Z"}}],"participationCoverage":{"total":2,"returned":2,"complete":true,"fullAssertions":"source-metadata-endpoint"},"distribution":null,"publisher":{"name":"Anthropic","url":"https://www.anthropic.com/"},"sourceUrl":"https://www.anthropic.com/research/discovering-vulnerabilities-with-claude","snapshotId":"4fe1a2649d532e3659c5e2ba1fbee0f83a659392580807df6aef615c6ac9013d","contentSha256":"d7835b78f66b4f2b18a995660c2f1f107eda76a4589d99b68767402b1deec63f","textHash":"43027fc0b5d5e040e96393e45e9a07715382afce424a104c81d84a81d17a68f9","observedAt":"2026-10-29T16:17:54.627Z","basis":"publisher-page-metadata","sourceLinks":8,"linksTruncated":false,"metadataUrl":"/api/pipeline/stream/84c70b1e9cb8b4fd997f435fa6d196b08d4ff7bb917f00408a5d0139320fb34f/source"}}}],"audits":[{"publicationId":"c6b67fe8-3665-424e-81fd-82b39fdc6ac4","verdict":"uncertain","findings":[{"dimension":"attribution","status":"pass","explanation":"The title, summary and claims attribute the findings, methods and recommendations to Anthropic using phrasing such as 'Anthropic says' and 'Anthropic reports.' The source is Anthropic's own research post. The interpretive claim is labeled as an Escape Meridian interpretation.","excerpt":"we’ve used an unreleased, internal research model to find critical vulnerabilities in some of the world’s most widely used software"},{"dimension":"summary","status":"uncertain","explanation":"The reading covers the five chains, disclosure and methods accurately, but it weakens the source's central defender thesis. Anthropic itself argues that exploit-building skills once limited to a few specialist teams are now something models can do with little human involvement. The draft folds this into an Escape Meridian interpretation instead of attributing it to Anthropic. It also omits Anthropic's closing advice that defenders should scan their own code. Smallest repair: add one attributed sentence stating Anthropic's claim and its advice. Terms such as remote code execution and test-time compute scaling are kept exact and should rely on tooltips.","excerpt":"These skills have historically been the domain of few specialist teams with expertise in these targets. Now, it’s something models can do with little human involvement"},{"dimension":"date","status":"pass","explanation":"The evidence gives originalPublished as 2026-10-27, based on the publisher page, and it matches the feed entry. Nothing indicates an earlier first publication. The draft makes no conflicting date claim.","excerpt":null},{"dimension":"support","status":"pass","explanation":"Each claim is grounded in the source. The source describes five chains across Chrome, Safari, Android, Windows and Linux, and it states fixes or patches for each. It describes parallel scanning agents, varied strategies and a verification pipeline, and it recommends PR-time scanning. The interpretation is conditional and supported by Anthropic's own statement. The limitations correctly note there is no independent evaluation or comparison, and the open question does not overstate the source.","excerpt":"Fixing the existing backlog only solves half the problem; the other half is cutting the rate at which new vulnerabilities enter the codebase. For that, we recommend scanning at PR time."},{"dimension":"media","status":"pass","explanation":"The selected media is the verified direct link to the original Anthropic article. This is the most direct way for a reader to access the source. The alternative candidate is only a logo image.","excerpt":null}],"createdAt":"2026-11-07T01:16:46.644Z","model":"anthropic/claude-opus-5.5"}],"correctionUrl":"https://escapemeridian.com/corrections/"}