Finding an exploitable flaw in software

Two things keep this contested rather than ceded. The figures come from the company that sells the model, and no one has run the comparison that would settle it, a set of unseen targets given to the best human researchers and to the machine at the same time. What can be checked is suggestive. Independent firms triaged 1,752 of the flaws found in open source code and found 90.6 percent of them valid. Anthropic's own report says penetration testers put at weeks the exploits the model wrote in hours, and its engineers with no security training obtained working remote code execution overnight. The company's summary of what changed is the part worth keeping: the limit on software security used to be how fast a flaw could be found, and it is now how fast one can be verified, disclosed and patched. Maintainers asked for slower disclosure. On 11 May 2026 Google's threat intelligence group documented criminals using a model to find and weaponise an unknown flaw, which settles the question of whether this stays on the defensive side.