Anthropic ran Claude over 25 open-source projects, found 493 security issues

Anthropic published early data from a new line of security research. Over 25 open-source projects, representing more than five million lines of code written in C, C++, Java, PHP and Python, Claude catalogued over 17,000 configuration options and flagged 493 attack-surface issues. The company says the results are a preview rather than a finished paper, and the post was published on 20 October.

The research is about reachability, not about finding named bugs. Claude was asked to measure how much code an unauthenticated or unprivileged client can reach by default, and then to describe how to put more of that code behind a check. Three methods were used: changing default configurations, finding configuration interactions that silently weaken a control, and reducing early code reachability before authentication.

What Claude found across the 25 projects

The 25 projects were split into three cohorts. Eleven of them were "gated", meaning a user is expected to authenticate before most functionality is reachable. In every one of those eleven, Claude found code reachable before authentication that the project did not intend to expose. The specific counts: 93 unnecessary pre-authentication surfaces in the default configuration, 37 locations where code ran or state was recorded before authentication, and 61 configuration combinations that silently weakened a pre-authentication control an administrator had set.

Configuration interactions produced some of the strongest findings. Claude found 162 security-sensitive combinations of options that were accepted with no error and no documented behaviour. In 94 of those, the combination silently turned a security control off. One recurring pattern turned up in four unrelated projects: an access rule written against a hostname rather than an IP would be compared, with reverse DNS lookups disabled, against an address string, and would silently fail open.

The OpenSSH case

The project with the largest reduction in reachable code, measured as a percentage of lines, was OpenSSH 10.4. Claude traced the input paths of the SSH daemon and found about 4,500 lines of new ML-DSA-44 code, a post-quantum signature algorithm not enabled by default, that an unauthenticated client could reach. OpenSSH had added a check in 10.5 to gate this code, and Claude then found two gaps in that check: a client could advertise one algorithm name and send a key of a different type, and a certificate's embedded CA public key was deserialised and verified with any supported algorithm before configuration was consulted.

Anthropic says the maintainers shipped the fix in OpenSSH 10.6. The change removed roughly a fifth of the OpenSSH code that an unauthenticated client previously could have reached in a default build. Most of that is the ML-DSA code, which is now unreachable by a client that lies about its key type or hides an ML-DSA CA key inside an otherwise acceptable certificate.

The reader's practical point from this research is that patching named vulnerabilities, even critical ones, says nothing about how many unknown vulnerabilities sit behind the same unauthenticated code paths. The method Anthropic describes is something a working team can run on its own project: ask the model to inventory what is reachable without authentication, then move code behind a gate or remove it, so that the next unknown bug is sitting behind a check instead of in the open.

Source

Using Claude to reduce the attack surface of code, Anthropic