Discovering and exploiting vulnerabilities in real-world software with Claude
Comments on “Discovering and exploiting vulnerabilities in real-world software with Claude”
Claim-checked. Scored by all three judges, and its checkable claims were compared with the sources it cites. How far stories are checked
Anthropic describes five exploit chains its unreleased research model produced against Chrome, Safari, Android, Windows QUIC and the Linux kernel, including a one-click Chrome escape and a zero-click Linux root exploit that took 53 minutes in a proof of concept. Patches and the 62 Chrome CVEs are reported by Anthropic and were not independently verified, nor was the estimate of millions of exposed Windows servers. For builders, the stated lesson is to run many varied scanning agents and check code at pull-request time.
Why it ranked
No. 2 of 155 with a score of 0.78. The panel rated it highest on new information (0.90) and reader interest (0.89), lowest on substantiated (0.77).
- AI judgeJudge 2claude-haiku-5-5
- Detailed, technically rich account of AI-discovered exploit chains in Chrome, Safari, Android, Windows and Linux; highly relevant to builders and security, with some vendor-sourced claims and promotional closing about a program.
- AI judgeJudge 3gpt-5.6-luna
- A detailed primary technical account of AI-assisted discovery and exploitation of critical vulnerabilities across major platforms, with concrete chains, CVEs, methods, and defensive implications; somewhat promotional and occasionally broad in its conclusions.
Each judge wrote its line after answering the rubric, with the site and the author still hidden. Every answer behind this is in the table under Score.
Score
0.78total under rubric v2.2
- Significance0.87
- Reader interest0.89
- Audience breadth0.87
- Practical relevance0.82
- Substantiated0.77
- Technical depth0.87
- New information0.90
- Counts against: Promotional0.24
- Counts against: Overclaim0.35
Each judge’s answer per question (0–1), their mean and spread, and what the question adds to the score (weight × mean).
| Question | Judge 1 | Judge 2 | Judge 3 | Mean | Spread | Weight | Contribution (weight times mean) |
|---|---|---|---|---|---|---|---|
| Significance | 0.90 | 0.80 | 0.92 | 0.87 | 0.12 | +0.24 | +0.210 |
| Reader interest | 0.79 | 0.92 | 0.96 | 0.89 | 0.17 | +0.26 | +0.231 |
| Audience breadth | 0.95 | 0.85 | 0.82 | 0.87 | 0.13 | +0.13 | +0.114 |
| Practical relevance | 0.79 | 0.80 | 0.88 | 0.82 | 0.09 | +0.22 | +0.181 |
| Substantiated | 0.73 | 0.70 | 0.88 | 0.77 | 0.18 | +0.05 | +0.039 |
| Technical depth | 0.85 | 0.85 | 0.91 | 0.87 | 0.06 | +0.05 | +0.044 |
| New information | 0.91 | 0.85 | 0.93 | 0.90 | 0.08 | +0.05 | +0.045 |
| Promotional | 0.16 | 0.15 | 0.42 | 0.24 | 0.27 | −0.19 | −0.046 |
| Overclaim | 0.33 | 0.30 | 0.43 | 0.35 | 0.13 | −0.11 | −0.039 |
| Sum of contributions | +0.777 | ||||||
| Claim-check penalty | 0.000 | ||||||
| Total, as published | 0.777 | ||||||
Spread is the highest minus the lowest judge answer. marks a spread above 0.40: the judges disagree, and the story is marked contested.
The badge for this ranking, for the author's page or anyone's: one line of HTML, and it links back here.
<a href="https://rubric.hrih.si/editions/2026-10-28/2/"><img src="https://rubric.hrih.si/badge/2026-10-28/2.svg" alt="Ranked #2 on Rubric, 28 Oct 2026" width="238" height="28"></a>Claim check
Claim check: 3 no source given · 5 couldn’t check. Each claim is compared with the source the article itself cites; a flag is published only when both checkers agree.
Couldn’t checkNumber
Google assigned 62 CVEs for the vulnerabilities Anthropic reported in Chrome, all patched as of Chrome 156 and rated critical or high severity.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “62 CVEs have been assigned and patched as of Chrome 156, with all of them rated critical or high severity”
The source says No passage could be compared.
Source cited by the article: chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
Couldn’t checkNumber
Among the Chrome CVEs are 13 sandbox escapes and 21 vulnerabilities that could have been used to compromise the renderer.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “Among them are 13 sandbox escapes and 21 vulnerabilities that could have been used to compromise the renderer”
The source says No passage could be compared.
Source cited by the article: chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
Couldn’t checkVersion
Apple fixed the Safari vulnerability chain reported by Anthropic, and the fix is available to users.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “Apple acknowledged our report the same day we submitted it and implemented a fix promptly. That fix is available to users”
The source says No passage could be compared.
Source cited by the article: support.apple.com/en-us/127594
Couldn’t checkVersion
Microsoft resolved the Windows QUIC out-of-bounds read vulnerability and assigned it CVE-2026-33096.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “we reported this vulnerability directly to Microsoft, which resolved the vulnerability and assigned it CVE-2026-33096”
The source says No passage could be compared.
Source cited by the article: nvd.nist.gov/vuln/detail/cve-2026-33096
No source givenNumber
Anthropic estimates there are likely several million Windows servers listening on the internet that are exposed to the HTTP/3 vulnerability.
The article gives no link or citation for it.
The article says “We estimate that there are likely several million such servers listening on the internet”
The source says No source to compare with.
No source givenNumber
In Anthropic's proof of concept for the Linux multipath TCP exploit, it takes 48 minutes to leak a kernel pointer and another five minutes to reach shell command execution.
The article gives no link or citation for it.
The article says “it takes 48 minutes to leak a kernel pointer and another five minutes to reach the shell command execution”
The source says No source to compare with.
Couldn’t checkVersion
The Linux kernel vulnerability CVE-2026-98432 was patched upstream and backported to all maintained stable kernel branches.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “This vulnerability (CVE-2026-98432) was patched upstream and backported to all maintained stable kernel branches”
The source says No passage could be compared.
Source cited by the article: tenable.com/cve/CVE-2026-98432
No source givenGeneralization
Test-time compute scaling and scanner diversity substantially increase how many vulnerabilities are found.
The article gives no link or citation for it.
The article says “Test-time compute scaling and scanner diversity substantially increase how many vulnerabilities you find”
The source says No source to compare with.
Also covered by
No other coverage was clustered with this story.
Elsewhere
Elsewhere: HN 13 pts, not on front page
Recorded for context only, checked 28 Oct 2026, 06:47 UTC. It played no part in the ranking.