Did someone actually go through all of those and check if they are high-severity or did the AI just tell them that?

They mention that they have humans review the most crticial bugs before sending it to the maintainers in their dev blog.

Every piece of software definitely has serious vulnerabilities, perfection is not achievable. Fortunately we have another approach to security: security through compartmentalization. See: https://qubes-os.org

Once you get the compartmentalization working well, and “all” of the vulnerabilities are out of it too, of course…

But even then you’ll have users putting things in the same compartment for convenience, rather than leaving them properly sequestered.

> and “all” of the vulnerabilities are out of it too

This is a good point; however the isolating code should be much smaller and easier to verify.

Or more likely, its just an exaggeration or lie.

What evidence makes you say that? Do you have insider info?

Neither party provided the evidence. I wonder why people like to take the side of the optimistic.

We already know Opus can find real vulnerabilities ([1], [2], ...), so it's not exactly surprising that a bigger model is better at it.

[1] https://news.ycombinator.com/item?id=47273854

[2] https://news.ycombinator.com/item?id=47611921

That is not thousands high-severity vulnerabilities as above commenter stated. Even many local models have found individual vulnerabilities.

What evidence do we have that it is true?

I don't need any. I'm not making the claim that it's "most likely a lie".

pssst. It is. They all have the same investors and customers to please.