Daniela Amodei

Factual · AI capabilities

“including open-source code much of the internet runs on, before attackers could exploit them.”

Daniela Amodei, Anthropic co-founder and president, foreword · 21 October 2026 · Anthropic 2026 Public Benefit Report: Taking stock of our progress (foreword by Daniela Amodei) (Anthropic)

Cyberdefenders directed Claude to find more than 33,000 critical and high-severity flaws in widely used software, including open-source code, before attackers could exploit them.

Mostly true True in substance, wrong in a detail.

The second judge would not resolve this claim; the verdict shown is the first judge's.

The evidence is the person's or their organisation's own records.

Said for an organisation they lead or work for; it counts on both records.

What would count as true or false

Judged as of 2026-10-21. True: Anthropic reports or credible third-party reports from on or before that date show that cyberdefenders used Claude to find more than 33,000 critical and high-severity vulnerabilities in widely used software, including open-source code, and that the flaws were found before attackers exploited them (for example, they were disclosed or patched first). Mostly true: the count is above 33,000 and the other parts hold, but a minor detail is off, such as how many were confirmed exploitation-free. Mostly false: the count is just under 33,000 (within 2%), or the count of over 33,000 includes medium- or low-severity flaws, or the flaws were not limited to widely used software. False: the count is well below 33,000, or the evidence shows no such programme. Anthropic's own statement counts only if it gives the count and the severity basis; independent confirmation, such as CVE or advisory tallies or partner reports, strengthens it.

Evidence

1. Expanding the Cyber Verification Program Anthropic · 6 October 2026 Own record

   “Of these verified vulnerabilities, more than 33,000 have so far been rated as critical- or high-severity.”

2. Expanding the Cyber Verification Program Anthropic · 6 October 2026 Own record

   “This is likely an undercount, as it is based on survey data from only a subset of Glasswing partners.”

3. Anthropic’s open source vuln scans shift bottleneck to maintainers TechTarget · 30 October 2026

   “As of Oct. 2, Anthropic said its advanced models, including Claude Mythos, had found 29,432 candidate vulnerabilities in open source software.”

4. Anthropic’s open source vuln scans shift bottleneck to maintainers TechTarget · 30 October 2026

   “Notably, however, the frontier AI lab was able to manually review and triage only 6,123 of those, ultimately resulting in 513 findings patched upstream.”

Reasoning

In its 2026-10-06 announcement, Anthropic says that more than 33,000 of the verified vulnerabilities had so far been rated critical or high severity (E1). It describes that figure as likely an undercount because it rests on survey data from only some Glasswing partners (E2). That covers the count and severity basis the criteria require from Anthropic's own statement. The quoted evidence does not show that the flaws were in widely used software or that they were fixed before attackers could exploit them. TechTarget's independent reporting covers a different metric: 29,432 candidate open-source vulnerabilities from Anthropic's own scans, of which only 6,123 were triaged and 513 patched upstream (E3, E4). So the evidence gathered includes no independent confirmation of the 33,000 figure, and it does not establish how many flaws were remediated before exploitation.

Cite this claim

Daniela Amodei, “Cyberdefenders directed Claude to find more than 33,000 critical and high-severity flaws in widely used software, including open-source code, before attackers could exploit them.” (said 21 October 2026). Verdict: mostly true. Reliability API, claim c_6a0601e9c3a7, method 0.1.0+28da144b. https://epistacklabs.com/claims/c_6a0601e9c3a7