Anthropic says Claude has helped disclose 6,157 open-source vulnerabilities

Anthropic is publishing the progress of a coordinated vulnerability disclosure program that uses Claude models to discover security flaws in open-source software. Its official October 2, 2026 snapshot reports 6,157 disclosed vulnerabilities across 591 open-source projects, with 516 patched upstream.

Claude finds candidates, humans validate them

Anthropic says Claude models, including an early Claude Mythos Preview snapshot, generate vulnerability candidates. External security research firms then triage and validate findings before confirmed issues are privately reported to maintainers.

The dashboard shows 29,439 discovered candidates, 6,123 triage candidates and 5,674 findings reviewed by external security firms. Anthropic reports a 92.7% true-positive rate among the reviewed candidate set.

584 CVEs or GitHub Security Advisories

As of the snapshot, 584 identifiers had been issued across CVE records and GitHub Security Advisories. Anthropic follows a coordinated disclosure process, giving maintainers time to address vulnerabilities before detailed information becomes public.

What it means for users

The practical takeaway is not that every disclosed issue immediately affects every user. A fix being available upstream also does not mean it has already reached every application, operating system or package that depends on the affected project.

For U.S. developers and organizations, the program reinforces the importance of dependency tracking, prompt patching and monitoring security advisories for open-source components.

KX3 perspective: AI is moving from writing code to finding how it breaks

Coding models are usually judged by how well they generate software. Anthropic’s program shows another increasingly practical role: scanning large codebases for flaws at a scale that would be difficult to achieve manually.

Anthropic also says human review remains the rate-limiting step. That is a useful reminder that high-volume AI discovery does not remove the need for security expertise, responsible disclosure and careful validation.

Source

Snapshot date: October 2, 2026

Primary source: Anthropic Frontier Red Team — Coordinated Vulnerability Disclosure Dashboard

Image: Unsplash / Taylor Vick

日本語版を読む