Anthropic just launched Claude Opus 4.6 and showed how it found 500+ vulnerabilities in heavily-fuzzed open source projects
No custom harness, no specialized prompting.
Highlights:
- GhostScript: Claude read git history, found a bounds-checking commit, then identified a second code path in gdevpsfx.c where the same fix was never applied.
- OpenSC: Identified unsafe strcat chains writing into a PATH_MAX buffer without proper length validation. Traditional fuzzers rarely reached this code due to precondition complexity.
- CGIF: Exploited a subtle assumption that LZW-compressed output is always smaller than input. Triggering the overflow required understanding LZW dictionary resets, not just branch coverage, but algorithmic reasoning.
My take:
- A big step in LLM-driven vulnerability discovery with no scaffolding.
- Claude Code is becoming a de facto sec eng workhorse tool.
- Watch for Anthropic's next step in releasing a full security product.