Yes I understand, but I'm also putting the direct claims right there, not filtered through Anthropic's PR or an article from the IT industry press interpreting those PR statements.
These are real CVEs that have actually been submitted to the code maintainers for both FOSS and closed source software that is foundational to the computing world. Some of them are published in this post. And many more are simply described with a hash of the full writeup indicating that they have it written out and are waiting for the patches to be applied. I'm especially interested in the Virtual Machine Monitor and the exploits for jumping out of browser sandboxes for "all major browsers."
Some of the published CVEs in the blog post seem pretty serious, especially the FreeBSD remote root access for devices running NFS. The OpenBSD one is a critical DOS vector, and the FFMPEG one is just a bug that doesn't seem to actually expose the software to any practical exploits but should still be patched.
But they've staked it out with their public disclosure of the hashes and a description of a few of the problems. These are big bold claims that are provided in a format that will be easily falsifiable in due time. And treating it as just marketing fluff ignores the shades of gray that actually apply to corporate claims.