Four bugs in four hours, and the sentence doing all the work
On the same day, an agent found four pre-auth bugs in thirty-year-old control software and Anthropic published five full exploit chains. Read the fine print in both and the model is not the story.
Two things landed on October 27 that are going to be quoted together for a while.
CISA published ICSA-26-300-01: four vulnerabilities in EPICS Base, the open-source toolkit behind the control systems at particle accelerators, synchrotrons and ITER's fusion reactor. The worst, CVE-2026-114595, is a CVSS 9.8 integer overflow in network request handling that wraps a buffer size and lets an unauthenticated attacker write past the heap. All four are reachable with nothing but network access to Channel Access on TCP 5064 or pvAccess on 5075. Causal Security's agent, Cipher, found all four in three hours and forty-nine minutes, starting with no knowledge of EPICS. By its own reading of the commit history the bugs are between fourteen and a half and thirty-one and a half years old.
The same day Anthropic's Frontier Red Team published five attack chains from an unreleased internal model: a one-click sandbox escape in Chrome (62 CVEs assigned, 13 of them sandbox escapes), a data-only same-origin bypass in Safari that never executes code, an Android lock-screen bypass over USB, a remote kernel crash in Windows' HTTP/3 stack, and a zero-click root on Linux through a race in multipath TCP that takes 48 minutes to leak a kernel pointer and five more to run a command.
Both are real. Both are impressive. And both writeups contain a sentence that is carrying more weight than the headline.
"After initial prompting"
Every one of Anthropic's five chains opens with the phrase after initial prompting. It is a modest phrase, and for the Windows case they tell you what it hides: they handed the model a Windows binary, told it to reverse-engineer the relevant code with Ghidra, write a fully annotated C program that reproduces the behaviour, check the reproduction against the binary, and only then hunt for bugs. When the first pass came back thin, they asked it to look for higher-risk issues. That is not a prompt. That is a methodology, with a verification step in the middle, designed by people who already knew how to find this class of bug.
Causal is more direct about it. The first phase of the EPICS work ran without a human. Then came, in Shubham Raj's words, "one instruction authorizing deeper exploitability testing in a secure environment." The agent found the shape of the bugs on its own; a person decided it was allowed to prove them. The result CISA published is the output of that second phase, and it is the second phase that turns "this looks wrong" into a 9.8.
The result we can actually measure
We have one controlled data point on this question and it is why I trust the reading above. In July, ETH Zurich's SPY Lab released CryptanalysisBench, which hands an agent a live cryptographic scheme and counts nothing until a verifier confirms the attack fires. We took the exact model the paper reports, Claude Opus 4.8, kept the paper's protocol and budget, and changed only the scaffold around it. On the harder Tier-2 set the paper's own model went from 31 of 140 to 39 of 140, a 26% relative gain, with nothing else moving.
Same model, same budget, same verifier. The harness was the variable, and it was worth a quarter of the score.
That is a benchmark, not a production system, and I would not stretch it further than it goes. But it is the cleanest evidence I know of for what both of Monday's writeups are quietly telling you: the frontier model is necessary and nowhere near sufficient. How you decompose the target, what you let the agent do, when you make it reproduce before it is allowed to speculate, and what counts as done — those are the decisions that separate a plausible-sounding report from a CVE with an advisory.
Why this matters for anyone who isn't a lab
Most of the discussion this week will be about capability, and whether an unreleased model finding sixty-two Chrome bugs is a threshold crossed. That is a fair conversation. It is also the wrong one for most defenders, because you will not get Anthropic's internal model and you do not need it.
What you need is the harness. EPICS had pre-auth memory corruption on an exposed port for three decades and nobody looked, because looking was expensive and the people who could look were busy. The cost of looking has collapsed. Cipher spent an afternoon. Chainguard re-found PHP2Shell in an evening. Those teams were not working with secret weights; they were working with a frontier model inside a loop that forces it to prove what it claims.
That is the part that transfers. Build it, or buy it, but do not read Monday's news as "the model did it." The model was in the room. Someone else wrote the procedure.
Sources: CISA ICSA-26-300-01, Causal Security's advisory ledger, The Register's and SecurityWeek's interviews with Shubham Raj, Anthropic's Discovering and exploiting vulnerabilities in critical, real-world software with Claude, and our own CryptanalysisBench run.