Anthropic used Claude to analyze 25 open source projects and uncovered nearly 500 security issues
Research found exposed pre-authentication code paths, conflicting security settings, and long-hidden flaws
AI identified attack-surface reductions that removed unnecessary code exposure before vulnerabilities could be exploited
Anthropic recently used Claude to analyze 25 major open source projects written in C, C++, Java, PHP, and Python, in search of security issues. It found almost 500 of them, including security controls turned off by conflicts in settings, sensitive code accessible before authentication, and even a vulnerability that sat in the code for 21 years. This wasn’t a standard hunt for vulnerabilities. In its report , Anthropic argues that looking for individual vulnerabilities is a Sisyphean task that scales poorly and never guarantees security. Instead, it thinks defenders should turn towards reducing software attack surfaces by restricting unnecessary access to potentially exploitable code. “A defender who reduces unnecessary attack surface in their code reduces the risk from all of the unknown vulnerabilities in that code at once—including any that are already being quietly exploited,” Anthropic said. The 25 projects it scanned contained more than five million lines of code. Claude created an inventory of more than 17,000 configuration options, 3,842 of which related to security-relevant controls and features. Misconfigured security controls
The company’s research focused on three ways code may get unnecessarily exposed: features accessible in the default configuration when they’re not needed, different settings which, when combined, erode security, and unnecessarily complex and sensitive code running before security checks. The analysis showed all 11 projects, which were designed to serve authenticated users, contained code that was reachable when it shouldn’t have been. These include 93 pre-authentication attack surfaces in default configurations, 37 instances of code executing before authentication, and 61 combinations of different configurations that eroded pre-authentication controls…