Anthropic says Claude found nearly 500 security issues in 25 open-source projects, including a flaw hidden for 21 years
Anthropic reports using Claude to analyze 25 open-source projects, uncovering nearly 500 security issues and a configuration conflict that persisted for 21 years, advocating for AI-driven attack surface reduction.
US artificial intelligence company Anthropic recently published a research report stating that it used its Claude model to analyze 25 major open-source projects written in C, C++, Java, PHP, and Python, discovering nearly 500 security issues. These included sensitive code accessible before authentication, security controls disabled by conflicting settings, and a vulnerability that had remained undetected in the code for 21 years.
In its report, Anthropic argues that hunting for individual vulnerabilities is a Sisyphean task that scales poorly and never guarantees security. Instead, it advocates for defenders to use AI to systematically reduce software attack surfaces. For example, in a case study on OpenSSH, Claude identified a configuration flaw allowing unauthenticated clients to access 4,500 lines of experimental code, even though the feature was disabled by default. After Anthropic disclosed the findings, OpenSSH fixed the issue in version 10.6, making approximately 20% of the code unreachable by unauthenticated users.
The analysis covered more than five million lines of code, with Claude generating an inventory of over 17,000 configuration options, 3,842 of which were security-relevant. The report noted that all 11 projects designed to serve authenticated users contained code paths that should not have been reachable. Anthropic stated it would combine these techniques into a reusable Claude skill, planned for integration into OSS-Scanner, its free, opt-in security scanning service for open-source projects.