Cyberdefenders directed Claude to find more than 33,000 critical and high-severity flaws in widely used software, including open-source code, before attackers could exploit them.

Judged as of 2026-10-21. True: Anthropic reports or credible third-party reports from on or before that date show that cyberdefenders used Claude to find more than 33,000 critical and high-severity vulnerabilities in widely used software, including open-source code, and that the flaws were found before attackers exploited them (for example, they were disclosed or patched first). Mostly true: the count is above 33,000 and the other parts hold, but a minor detail is off, such as how many were confirmed exploitation-free. Mostly false: the count is just under 33,000 (within 2%), or the count of over 33,000 includes medium- or low-severity flaws, or the flaws were not limited to widely used software. False: the count is well below 33,000, or the evidence shows no such programme. Anthropic's own statement counts only if it gives the count and the severity basis; independent confirmation, such as CVE or advisory tallies or partner reports, strengthens it.

Set before the research began.

1. E1 Expanding the Cyber Verification Program Anthropic · 6 October 2026 Own record

   “Of these verified vulnerabilities, more than 33,000 have so far been rated as critical- or high-severity.”

2. E2 Expanding the Cyber Verification Program Anthropic · 6 October 2026 Own record

   “This is likely an undercount, as it is based on survey data from only a subset of Glasswing partners.”

3. E3 Anthropic’s open source vuln scans shift bottleneck to maintainers TechTarget · 30 October 2026

   “As of Oct. 2, Anthropic said its advanced models, including Claude Mythos, had found 29,432 candidate vulnerabilities in open source software.”

4. E4 Anthropic’s open source vuln scans shift bottleneck to maintainers TechTarget · 30 October 2026

   “Notably, however, the frontier AI lab was able to manually review and triage only 6,123 of those, ultimately resulting in 513 findings patched upstream.”

In its 2026-10-06 announcement, Anthropic says that more than 33,000 of the verified vulnerabilities had so far been rated critical or high severity (E1). It describes that figure as likely an undercount because it rests on survey data from only some Glasswing partners (E2). That covers the count and severity basis the criteria require from Anthropic's own statement. The quoted evidence does not show that the flaws were in widely used software or that they were fixed before attackers could exploit them. TechTarget's independent reporting covers a different metric: 29,432 candidate open-source vulnerabilities from Anthropic's own scans, of which only 6,123 were triaged and 513 patched upstream (E3, E4). So the evidence gathered includes no independent confirmation of the 33,000 figure, and it does not establish how many flaws were remediated before exploitation.