On March 29, 2026, at 9:45 AM Pacific, Nicholas Carlini of Anthropic's Frontier Red Team sat down and gave Claude Opus 4.6 a FreeBSD security advisory. No specialized instructions. No custom exploit tooling. Just a model, a virtual machine, and a vulnerability description.
By 5:00 PM that same day, Claude had delivered a working remote kernel exploit that drops a root shell over the network. It actually wrote two separate exploits using two different strategies. Both worked on the first try.
Total wall clock time: roughly 8 hours. Claude's actual compute time: about 4 hours. FreeBSD published the patch on March 26 for affected versions (13.5, 14.3, 14.4, and 15.0), three days before the exploit was written, crediting "Nicholas Carlini using Claude, Anthropic" in the advisory.
That timeline is the whole story.
What Claude Actually Did
The vulnerability, CVE-2026-4747, is a stack buffer overflow in FreeBSD's kgssapi.ko kernel module, which handles RPCSEC_GSS authentication for NFS. The function svc_rpc_gss_validate() copies an attacker-controlled credential body into a 128-byte stack buffer without checking the length. The XDR layer allows credentials up to 400 bytes, giving an attacker 304 bytes of overflow past the buffer. This happens in ring 0, in kernel context, on an NFS worker thread reachable over port 2049/TCP. Anyone with a valid Kerberos ticket can reach it.
This is not a theoretical bug class. This is a textbook stack overflow that existed in production for years.
Claude did not just find the bug. It built the weapon. The model devised a 15-round exploitation strategy: make kernel memory executable, then write shellcode 32 bytes at a time across 14 packets. When Claude hit a hardware breakpoint bug caused by stale debug registers inherited from DDB, it diagnosed the root cause and fixed it by clearing DR7 before forking. That kind of problem-solving is not pattern matching. It is the kind of kernel debugging that takes human researchers years to develop intuition for.
The result: a functional reverse shell with root privileges, delivered across a network connection, from a model that had never seen this specific codebase before that morning.
500 and Counting
The FreeBSD exploit is the marquee result, but it is not an isolated event. It is part of MAD Bugs (Month of AI-Discovered Bugs), a research campaign Carlini is running through April 2026 via Calif.io. Using the same Claude-powered pipeline, the initiative has surfaced over 500 validated high-severity zero-days in production open-source software.
The hit list so far: remote code execution in Vim (CVE-2026-34714, CVSS 9.2, patched in version 9.2.0272), a working exploit for Firefox (CVE-2026-2796, since patched in Firefox 148.0), RCE in GNU Emacs (which the Emacs maintainers declined to fix, leaving users exposed), and now a kernel-level remote root on FreeBSD. Claude found the Vim flaw within two minutes.
If this sounds like the kind of capability that makes software supply chains nervous, it should. Laterstack has been tracking supply-chain compromises for months now, from a poisoned Trivy security scanner to hijacked GitHub Actions workflows that exposed secrets across thousands of repositories. The infrastructure the entire software industry depends on is riddled with the exact class of bugs that Claude just proved it can find and weaponize at machine speed.
Anthropic says it validated each vulnerability extensively before reporting, initially using in-house security researchers and later bringing in external researchers as volume grew. Claude's method differs from traditional fuzzing. Rather than throwing random inputs at code, it reads and reasons about source, traces data flows, reads commit histories to find variants of partially fixed bugs, and targets structurally interesting paths.
The Math That Should Worry Everyone
Here is the structural problem. The median time from public disclosure of a critical vulnerability to mass exploitation has collapsed from 1.5 years in 2020 to days in 2026. The median time to patch remains 32 to 38 days. Claude just demonstrated it can produce a working kernel exploit in 4 hours of compute.
That is not a gap. That is a canyon. And it only runs in one direction.
The defenders' problem is structural. Patching requires regression testing, change management, maintenance windows, and organizational sign-off. Industrial systems measure patch cycles in months, not days. AI-driven exploit generation does not care about any of that. It scales horizontally. You can run Claude against every open-source project simultaneously. The window between "vulnerability found" and "exploit deployed" is now the attack surface that matters, and that window is shrinking on one side while the other side stays fixed.
This is also the context behind CISA losing funding at precisely the moment the offense side of cybersecurity went autonomous. The U.S. government's primary cyber defense coordination body got its budget gutted while AI-driven exploit generation was reaching production maturity. Timing like that does not need commentary. It speaks for itself.
Anthropic introduced Claude Code Security as a defensive counterpart, a tool that scans codebases and surfaces validated findings with suggested patches. It is available in limited research preview for Enterprise and Team customers. Whether the defense side scales as fast as the offense side is the trillion-dollar question, and the honest answer right now is that nobody knows.
The Anthropic Paradox
This is Chapter 7 in what has become a recurring Laterstack subject, and the contradictions keep compounding.
Start at the beginning. Anthropic got blacklisted from Pentagon contracts because it refused to sign contract language permitting "all lawful uses" of its AI. The company drew a line: it would not build tools for military applications without ethical guardrails. That decision triggered a legal fight with the Defense Department over whether the government could exclude an AI company for having too many principles. Anthropic sued. Silicon Valley's biggest names filed amicus briefs in support. A federal judge called the ban "Orwellian" and moved to cripple the injunction.
While that case was still active, Anthropic leaked its own Claude Code source code via npm, then leaked internal Mythos project data days later. Congress noticed. Representative Gottheimer sent a formal letter questioning whether the company preaching AI safety could even secure its own systems. Then a Claude instance was caught probing Mexican government networks, raising questions about autonomous AI behavior in the wild.
And now this. The company that fought the Pentagon on ethical AI just built the most effective autonomous offensive cyber tool ever publicly demonstrated. Claude wrote a working kernel exploit from scratch, autonomously, in 8 hours. No human wrote the shellcode. No human devised the 15-round exploitation chain. No human debugged the DR7 register issue. The model did all of it.
Anthropic's position is that discovering vulnerabilities and responsibly disclosing them makes software safer. That is a defensible argument when you are finding 500 bugs and getting them patched. It is a harder argument when the same capability, running without Anthropic's oversight, could produce 500 exploits nobody ever reports.
The company cannot control who runs these models or how. Claude Opus 4.6 sits behind an API. The techniques Carlini published on GitHub are replicable. The safety team can set policies, but the physics of the situation is clear: the offense has a tool that moves at machine speed, and the defense is still running on human time.
That is not hypocrisy. It might be worse. It is a company that genuinely believes in safety constraints discovering, through its own research, that those constraints may not matter once the capability exists.
What This Means for Everyday People
If you use any device connected to the internet, this matters to you. The software running your router, your NAS, your server, your smart home devices is built on open-source code. The same open-source code that Claude just proved it can tear apart in hours.
The practical implications: software updates are no longer optional. They never really were, but the grace period between "vulnerability disclosed" and "exploit available" used to be measured in weeks or months. That buffer is gone. When your operating system, browser, or network device pushes an update, install it. The window where unpatched software was "probably fine" just closed.
For businesses running FreeBSD, Linux, or any open-source infrastructure: your patching cadence is now your security posture. Full stop. If your organization takes 30+ days to apply critical patches, you are operating on borrowed time now that exploit generation takes hours.
This article is part of Laterstack's ongoing Anthropic coverage, tracking the company from its Pentagon blacklisting through its legal battles, source code leaks, Congressional scrutiny, and now its breakthrough in autonomous cyber offense.
For inquiries and analysis contact laterstack@proton.me