LLM-discovered 0 days

Claude Opus 4.6 was evaluated in a simulated VM with access to open-source code and standard tooling and, without specialized harnesses or prompts, identified and validated over 500 high-severity vulnerabilities (notably in GhostScript, OpenSC, and CGIF). The report details the methodology for discovery and human validation, provides examples where the model produced proof-of-concept crashes or patches, and outlines new safeguards and disclosure practices to manage the dual-use cybersecurity risks of rapidly improving LLM capabilities.