Evaluating and mitigating the growing risk of LLM-discovered 0-days

The idea of using large language models (LLMs) to discover security problems is not new. Googl [...]

It has not been a relaxing few months for software security teams. In December, React disclosed its first critical CVE: an unauthenticated remote code execution flaw in Server Components. In March, not only was Aqua Security’s Trivy, a widely-used security scanning tool, compromised twice in three weeks through a GitHub Actions misconfiguration, but hackers also

How has AI progress compared to AI 2027 thus far?

Claude Code Security is one step towards our goal of more secure codebases and a higher security baseline across the industry.

25 comments

Claude Opus 4.6 discovered 22 Firefox vulnerabilities in two weeks, including 14 high-severity bugs, as nearly 20% of all critical Firefox vulnerabilities were fixed in 2025. The AI also wrote working exploits for two bugs, demonstrating emerging capabilities that give defenders a temporary advantage but signal an accelerating arms race in cybersecurity.

Talking fast and swearing more since 2004.

Anthropic is an AI safety and research company that's working to build reliable, interpretable, and steerable AI systems.

Talking fast and swearing more since 2004.

Open source components are getting compromised a lot more often. I did some counting, with a combination of searching, memory, and AI assistance, and we had two in 2026-Q1 ( trivy, axios), after four in 2025 ( shai-hulud, glassworm, nx, tj-actions), and very few historically [1]: Earlier attacks were generally compromises of single projects, but some time around Shai-Hulud in 2025-11 there sta

Anthropic's red team found 500+ critical vulnerabilities with Claude. But they focused on maintained software. The scarier problem is the long tail that nobody will ever patch.

AI Will Replace Hackers, But it Will Boost the Real Ones

Source I, for one, welcome our new insect overlords Kent Brockman in " Deep Space Homer ", The Simpsons In recent months Cy...

Homepage for Addison Crump

The arrival of Anthropic's Mythos jolted banks, software giants and governments into reckoning with a new era of cyber attacks. But the threat is already here.

We’re launching The Anthropic Institute, a new effort to confront the most significant challenges that powerful AI will pose to our societies.

LLMs now find kernel zero-days at scale. Here's why container isolation fails and why hardware-enforced workload isolation must become the default.

How has AI progress compared to AI 2027 thus far?

How has AI progress compared to AI 2027 thus far?

How has AI progress compared to AI 2027 thus far?

It’s no longer just about reverse-engineering n-days. You can detect vulnerabilities in open-source repositories before a CVE is published - or even if they’re never published. Here’s how I built an LLM workflow to detect “negative-days” and “never-days”.

Learn how Datadog detected and resolved issues from hackerbot-claw, an AI-powered automated attack campaign.

Anthropic is an AI safety and research company that's working to build reliable, interpretable, and steerable AI systems.

Anthropic framed Mythos and Project Glasswing as proof that frontier AI vulnerability research now needs gated access. We tested the public, patched cases with GPT-5.4 and Claude Opus 4.6 and found that the key building blocks are already accessible outside Glasswing, while reliable operationalization remains the real moat.

Returning champion Nicholas Carlini comes back to talk about using Claude for vulnerability research, and the current vulnpocalypse. It’s all very high-brow ...

Web design engineer, UX designer, teacher, and speaker – helping teams build websites and digital products with a focus on CSS, accessibility, and performance.

Minimal OpenClaw alternatives, scanning tools, and hardening guidance, PortSwigger's curated top web hacking techniques, open source GitHub Action to flag commits fixing vulnerabilities before they get a CVE

This report provides statistical data on published vulnerabilities and exploits we researched during Q1 2026. It also includes summary data on the use of C2 frameworks in APT attacks.

Anthropic is an AI safety and research company that's working to build reliable, interpretable, and steerable AI systems.

We’re upgrading our smartest model. Across agentic coding, computer use, tool use, search, and finance, Opus 4.6 is an industry-leading model, often by wide margin.

Opus 4.6 Finds Vulns the Way Human Testers Do, The SaaSpocalypse, Malicious OpenClaw Skills, New Urgency in Building, and more