500 Zero-Days Discovered in Claude Opus 4.6: A New Era of AI Security Research

TL;DR

• Anthropic released Claude Opus 4.6 on February 5, 2026
• Discovered over 500 zero-day vulnerabilities in pre-release testing
• Found in widely used open-source libraries such as GhostScript, OpenSC, and CGIF
• Discovered "out-of-the-box" without special prompting or custom tools
• All vulnerabilities were reported to maintainers and patched

Background: What Makes Opus 4.6 Different?

Anthropic announced Claude Opus 4.6 on February 5, 2026. This is an upgrade just three months after the release of Opus 4.5.

Key features:

• 1M token context window (first for Opus models)
• Agent Teams - Multi-agent collaboration feature
• Adaptive Thinking - Automatic reasoning level adjustment according to task complexity
• Outperforms GPT-5.2 and Gemini 3 Pro across benchmarks

But the real noteworthy thing isn't the numbers. It's the number 500, the number of zero-day vulnerabilities discovered in pre-release testing.

Experiment Setup: How Was It Tested?

Anthropic's Frontier Red Team put Opus 4.6 in a sandbox environment and provided:

• Source code for the latest open-source projects
• Python execution environment
• Standard vulnerability analysis tools (debugger, fuzzer, etc.)

What was not provided:

• Instructions on how to use the tools
• Prompts to find specific vulnerabilities
• Custom harnesses or specialized knowledge

In other words, it was a "figure it out yourself" setting. And Opus 4.6 found over 500 high-risk vulnerabilities.

Detailed Analysis of Discovered Vulnerabilities

1. GhostScript - Discovery through Git History Analysis

GhostScript is a widely used utility for PDF/PostScript processing. Opus 4.6's approach is interesting.

Attempt 1: Fuzzing → Failed Attempt 2: Manual code analysis → No meaningful results Attempt 3: Git commit history analysis → Success!

Opus 4.6 found security-related commits and reasoned as follows:

There is a commit related to "stack bounds checking for MM blend values". If this commit adds bounds checking, it means the previous code was vulnerable. There may be the same problem in other similar code paths.

And it found a unpatched vulnerability with the same pattern in gdevpsfx.c. It was code that called the same function but didn't have bounds checking.

Key Insight: The way AI learns "past modification patterns" and finds similar uncorrected vulnerabilities. This is the same methodology as a skilled security researcher.

2. OpenSC - Exploring Dangerous Function Patterns

OpenSC is a smart card data processing utility. Fuzzing failed here as well.

Next approach:

strrchr()와 strcat() 함수 호출을 검색해보자 - 
path traversal이나 buffer overflow가 자주 발생하는 패턴이다.

Discovered a point where strcat is called repeatedly:

char filename[PATH_MAX]; // 4096 bytes
r = sc_get_cache_dir(card->ctx, filename,
    sizeof(filename) - strlen(fp) - 2);
if (r != SC_SUCCESS)
    goto err;
strcat(filename,"/");
strcat(filename,fp);  // ← Buffer overflow 가능!

The reason why existing fuzzers hardly tested this code is because there are many preconditions for triggering it. Opus 4.6 was able to "understand" the code and infer which parts were vulnerable.

3. CGIF - Discovery Through Understanding the LZW Algorithm

CGIF is a GIF file processing library. This case is the most impressive.

GIF uses LZW compression. CGIF assumes that "the size after compression is smaller than the original". Usually this is a correct assumption.

But Opus 4.6 broke this:

When the LZW symbol table reaches its maximum size (4096), a 'clear' token is inserted. Repeating this can make the size after compression larger than the original → Heap buffer overflow occurs!

The peculiarity of this vulnerability:

• Cannot be discovered even with 100% line/branch coverage
• Requires a very specific sequence of operations
• Conceptual understanding of the LZW algorithm is essential

It is virtually impossible to discover with traditional fuzzers.

Comparison with Existing Tools

Even in codebases where projects like OSS-Fuzz have invested millions of CPU hours, Opus 4.6 has found vulnerabilities that have been hidden for decades.

Impact on the Security Industry

Positive Aspects

1. Potential to Secure a Defender Advantage Logan Graham (Anthropic Frontier Red Team Lead):

   "In the future, open source software security may be done primarily in this way."

2. Support for Under-Resourced Projects Many open source projects operate without a dedicated security team. AI-based vulnerability discovery can be of great help to them.

3. Combination of Human Verification + AI Discovery Anthropic verified all vulnerabilities with humans, and patches were also written by humans. A good model of AI-Human collaboration.

Concerns

1. Attackers Can Use the Same Tools DevOps.com article title: "Is Claude Opus 4.6 the Best Security Researcher Ever?"

   "What if a malicious actor is given 600 new vulnerabilities from day one?"

2. Dual-use Dilemma Powerful vulnerability discovery capabilities can be used for both defense and attack.

3. Importance of Responsible Disclosure Anthropic first induced patches through Responsible Disclosure. But will all AI providers do this?

Anthropic's Safeguards

New security measures were also introduced with the release of Opus 4.6:

• 6 new cybersecurity probes - Monitor model internal activation
• Real-time traffic analysis - Detect potential exploitation
• Usage pattern monitoring - Block suspicious behavior

Benchmark Performance (Reference)

Although not as important as zero-day discovery, Opus 4.6's overall performance is also impressive:

In particular, the 14.6% point lead over GPT-5.2 in ARC-AGI 2 shows a significant difference in "new problem-solving abilities."

Conclusion

The 500+ zero-day discoveries of Claude Opus 4.6 are not just marketing figures. This is an example of a paradigm shift in AI security research.

Key points:

1. AI can discover vulnerabilities by "understanding and reasoning about code"
2. Discovers complex logical vulnerabilities that cannot be discovered by traditional fuzzing
3. Can be a game changer for both defenders and attackers
4. Reinforces the importance of Responsible Disclosure and human verification

In the future, the key question will be what role AI will play in security research and how to use it responsibly.

References

• Anthropic Red Team Blog: 0-Days
• Anthropic News: Claude Opus 4.6
• The Hacker News: Claude Opus 4.6 Finds 500+ High-Severity Flaws
• Axios: Anthropic's Claude Opus 4.6 uncovers 500 zero-day flaws