Das neueste KI-Modell von Anthropic hat mehr als 500 bisher unbekannte Sicherheitslücken mit hohem Schweregrad in Open-Source-Bibliotheken gefunden, und das ohne oder ohne große Aufforderung

[Anthropic’s](https://archive.is/o/w1TAx/https://www.axios.com/2026/01/30/ai-anthropic-enterprise-claude) latest AI model has found more than 500 previously unknown high-severity security flaws in open-source libraries with little to no prompting, the company shared first with Axios.

**Why it matters**: The advancement signals an [inflection point](https://archive.is/o/w1TAx/https://www.axios.com/2025/12/16/ai-models-hacking-stanford-openai-warnings) for how AI tools can help cyber defenders, even as AI is also making attacks more dangerous.

**Driving the news:** Anthropic debuted [Claude](https://archive.is/o/w1TAx/https://www.axios.com/2025/09/17/ai-anthropic-amodei-claude) Opus 4.6, the latest version of its largest AI model, on Thursday.

* Before its debut, Anthropic’s frontier red team tested Opus 4.6 in a sandboxed environment to see how well it could find bugs in open-source code.
* The team gave the Claude model everything it needed to do the job — access to Python and vulnerability analysis tools, including classic debuggers and fuzzers — but no specific instructions or specialized knowledge.
* Claude found more than 500 previously unknown zero-day vulnerabilities in open-source code using just its „out-of-the-box“ capabilities, and each one was validated by either a member of Anthropic’s team or an outside security researcher.

Yeah, because people vibe coded the libraries, probably with Anthopic’s tools.

This isn’t impressive. It’s terrifying that these AI agents are just churning out security vulnerabilities, and no one is picking them up.

I know the maintainers of a medium popularity piece of open source. They’ve decided to shut down their public bounty program because people keep claiming that they’ve used AI to find security vulns. But when you scratch the surface, they’re not at all.