I'm curious to know what people think about Anthropic's claim that Claude found 500 high-severity vulnerabilities in open-source packages.

:ruby: a HOT Rubie :ruby:

@dangoodin 500 is such a nice, round number. Very much like a number a human would pick at random. That alone makes it rather suspect.

RootWyrm 🇺🇦:progress:

@dangoodin zero question it's pure fantasy bullshit. They refuse to show their work, as usual. All they've got is a middling CGIF vulnerability that isn't, and claiming credit for "finding" a vulnerability in GhostScript because "hey this commit did a thing so they must have had a vulnerability!"

RootWyrm 🇺🇦:progress:

@dangoodin if "this commit changed a thing to fix a bug" is the metric, well fuck, I've found over 100,000 'vulnerabilities' in the past year.

Fritz Adalis

@GossiTheDog @dangoodin
This looks like the first one.

https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=4e392a82d1b1780cab85804728317f36a9c4f7f7

Fritz Adalis

@GossiTheDog @dangoodin
Maybe #2
https://github.com/OpenSC/OpenSC/commit/9ab1daf21029dd18f8828d684ee6151d9238edab

Sharlatan

@dangoodin Daniel Steinberg mentioned on FOSDEM 2026 - full covered test suite is the wall none of "AI" could climb. I guess npm may provide even more vulnerable packages 987654321

Fritz Adalis

@GossiTheDog @dangoodin
For #3 there are a bunch of recent commits to the lzw code.

These really seem like bugs that existing scanners should have found, especially strcat use (#2).

Brandon Roberts

@dangoodin Gonna go out on a limb here and posit that Claude Code is creating vulns at a much faster rate

Michael Weiss

@dangoodin I said it elsewhere, but what's missing in my view is the false positive rate. Ok, it found 500. Did it flag 500? 5,000? 5,000,000? That's an important data point.

Dan Goodin

@rootwyrm

That's not what Antropic said. Antropic said the vulns were high-severity.

RootWyrm 🇺🇦:progress:

@dangoodin that is EXACTLY what Anthropic said. LITERALLY it is the FIRST "vulnerability" they bogusly claim to have found.

> Neither of these methods yielded any significant findings. Eventually, however, Claude took a different approach: reading the Git commit history. Claude quickly found a security-relevant commit, and commented:

Dan Goodin

Thanks for all the responses. So far, projects I understand to have received reports include: Ghostscript, OpenSC, lzw, and CGIF. Are others known? Links to commits that fix the vulns also appreciated.

Dan Goodin

@rootwyrm

Right, but the post doesn't say merely that the reports of the 500 vulns resulted in commits. It says all 500 were high-severity. If true, that would be significant, no?

RootWyrm 🇺🇦:progress:

@dangoodin to which I said "hang the fuck on" and read a bit more. And hey look, it's in fonts... bounds checking...

https://security.snyk.io/vuln/SNYK-CENTOS10-GHOSTSCRIPTTOOLSFONTS-10299121

Dan Goodin

@rootwyrm

CVSS is 7.8, which is high, no? That would seem to support the Anthropic's claim. What's the significance of the vulns being in fonts . . . bounds checking?

cerement

@dangoodin

(on the flip side, curl ending their bug bounty program because of the flood of slop reports)

Hippo Giraffe Covfefe

@cerement @dangoodin Exactly what I was going to point out.

RootWyrm 🇺🇦:progress:

@dangoodin the significance is that by their own words, they didn't discover shit. Check the date on that CVE. But they're trying to claim dishonestly that their magical almost-to-AGI stochastic parrot totally discovered it.
It did not. Period.

Dan Goodin

@rootwyrm

I'm not arguing with you. Sorry if it sounds like I am. I don't have the same technical background you do and am asking how the 7.8-severity vuln shouldn't be considered high severity because it involves fonts . . . bounds checking? I'm asking you to explain the reasoning behind your assessment as if I was a student in a security 101 class.