Neither party provided the evidence. I wonder why people like to take the side of the optimistic.

We already know Opus can find real vulnerabilities ([1], [2], ...), so it's not exactly surprising that a bigger model is better at it.

[1] https://news.ycombinator.com/item?id=47273854

[2] https://news.ycombinator.com/item?id=47611921

That is not thousands high-severity vulnerabilities as above commenter stated. Even many local models have found individual vulnerabilities.

What evidence do we have that it is true?

I don't need any. I'm not making the claim that it's "most likely a lie".