An unreleased Claude model didn’t just discover a flaw; it built a zero-click attack.