On February 6, 2026, Anthropic released Claude Opus 4.6. During testing, the model had found more than 500 previously unknown high-severity security vulnerabilities in open-source code libraries — with "little to no prompting." The same day, OpenAI released GPT-5.3-Codex, which it described as going beyond a coding agent "to an agent that can do nearly anything developers and professionals can do on a computer." The same day, the Wall Street Journal published an analysis arguing that investor fears of an AI-driven software extinction event were "exaggerated."
Five Hundred
The 500 zero-days deserve their own weight. These were not benchmark results. They were not demonstrations at a conference. They were real vulnerabilities in real open-source libraries — the code that underpins most of the internet — that the entire global security community had missed and a model found without being asked.
The global cybersecurity industry spends over $200 billion a year. Bug bounty platforms pay researchers to find exactly these flaws. Opus 4.6 found 500 of them during a pre-release evaluation, as a side effect of testing. The model wasn't looking for vulnerabilities. It noticed them.
This is the difference between capability in theory and capability in fact. A benchmark says a model can reason about code. Five hundred zero-days say it already has.
The Products
The 500 vulnerabilities were only one part of the Opus 4.6 launch. Bloomberg reported that the model was designed to "analyze company data, regulatory filings, and market information to create detailed financial analyses." That is a description of what financial data terminals sell for $25,000 a year — the core product of Bloomberg, FactSet, Refinitiv, S&P Capital IQ. On February 6, Anthropic shipped it as a model capability.
OpenAI's launch was broader. GPT-5.3-Codex wasn't positioned as a coding tool anymore. It was positioned as a general professional agent — "nearly anything developers and professionals can do on a computer." OpenAI also launched Frontier, an agent management platform with shared context, onboarding, and permission boundaries, "for a limited set of customers." Not a model. A platform for deploying agents into enterprises.
Two companies. Same day. One released a model that replaces specific professional functions (financial analysis, security research). The other released a platform for deploying agents that replace professional functions generally. The legal software industry called Anthropic's launch "a shot across the bow." A separate Wall Street Journal article reported that AI "threatens a Wall Street cash cow: financial and legal data."
The Evidence
The Feb 6 launches didn't arrive in a vacuum. They arrived into a market already registering the displacement.
On January 20, when Anthropic launched Claude Cowork two weeks earlier, Bloomberg reported that the product "revived investor fears about disruption that weighed on SaaS stocks in 2025." Morgan Stanley's SaaS index was already down 15% year-to-date — in January. The article's headline was blunter: "No Reasons to Own Software Stocks."
On February 5, Workday cut 400 employees to "invest in priority areas." On February 6, Heroku — the platform that defined cloud application deployment for a generation of developers — announced it was transitioning to a "sustaining engineering model." Sustaining engineering is what you call a product you're no longer building. It's maintenance mode with a better name.
SemiAnalysis reported that Claude Code already authors 4% of all public GitHub commits — on track to cross 20% by the end of 2026. Goldman Sachs disclosed it is working with Anthropic on AI agents to automate trades, transactions, client vetting, and onboarding. One in twenty-five lines of new public code is written by a machine. A major investment bank is automating core operations with AI agents. These are not projections. They are run rates.
The Concession
The Wall Street Journal's analysis was more nuanced than its reassurance. The headline said "exaggerated." But the subtext was a concession: AI won't kill the software business — just its growth story.
For most industries, slowing growth is an adjustment. For software, it's an identity crisis. SaaS companies trade at 10 to 30 times revenue because the market prices in compounding growth, high margins, and low marginal costs. Those multiples assume the future will be bigger than the present. If AI agents can do what the software does — if Opus 4.6 can analyze filings that Bloomberg Terminal users analyze, if Codex can automate what Workday's platform automates — then the growth story compresses even if the existing revenue holds. The companies survive. Their valuations don't.
The Journal was technically right. Software companies won't go extinct. But Morgan Stanley's SaaS index was down 15% in January alone — before Opus 4.6 and Codex arrived. Adobe had lost 45% of its market cap since 2023. Arm's CEO called the fear "a micro-hysteria." The hysteria was already priced in. The products that justified it launched on February 6.
The distinction between "exaggerated" and "real" is a distinction between timelines. The WSJ is correct that most software companies won't vanish this year. But the market doesn't price this year. It prices the trajectory. And on February 6, the trajectory got steeper: a model that outperforms security researchers unprompted, an agent platform for deploying AI into enterprises, a legacy developer platform entering hospice, and 4% of all new public code written by a machine — heading for 20%.
Exaggerated is what you call a fear before the evidence arrives. On February 6, they arrived together.