It's only been a few hours, but I'm surprised this hasn't gotten much response. Maybe the west coast hasn't woken up yet.

I question Anthropic and OpenAI's motives every time they do a fear mongering press release, but I think it's smart to draw attention to local exploits. Basically, if you aren't running software you don't trust, there isn't the same immediate panic as remote exploits. It advertises the problem without ruining everyone's day.

On the other hand, most people are running code that shouldn't be trusted. Browsers and games normalized automatic software updates, and lots of other applications followed. It's not just a matter of whether your system has remote vulnerabilities, we should be concerned if that terminal emulator or compiler you like is being updated from a server with vulnerabilities.