I see at least two more CVEs in that https://github.com/patrickmgarrity/Anthropic-Credited-CVEs repository that were most definitely "exploited in the wild" (https://www.cve.org/CVERecord?id=CVE-2026-93292 and https://www.cve.org/CVERecord?id=CVE-2026-92729) -- by virtue of being the one at my org who had to deal with it at the time. So I'm not sure what that person is basing this on.