It didn't find the exploits, it wrote code that made use of them. You can see them feeding it exploit descriptions, and samples of making use of them in their log files: https://github.com/SeanHeelan/anamnesis-release/blob/master/...