Claude Finds Nearly 500 Security Issues Across 25 Open-Source Projects

Anthropic says it used Claude to analyze 25 major open-source projects written in C, C++, Java, PHP and Python. The projects contained more than five million lines of code. The analysis found nearly 500 security issues, including exposed code, conflicting settings and a flaw that had gone undetected for 21 years.

Claude inventoried more than 17,000 configuration options, including 3,842 related to security controls and features. Anthropic examined whether unneeded features were enabled by default, whether combinations of settings weakened security, and whether sensitive code ran before security checks.

All 11 projects designed for authenticated users had code reachable when it should not have been. Anthropic reported 93 pre-authentication attack surfaces in default configurations, 37 cases of code running before authentication, and 61 setting combinations that weakened pre-authentication controls. Across all 25 projects, it found 162 configuration combinations whose behavior was not explained in their documentation.

Anthropic’s case study was OpenSSH. It found that a daemon could reach 4,500 lines of experimental code for a post-quantum signature algorithm before checking whether the server configuration allowed it. The algorithm was disabled by default, but unauthenticated clients could reach its parsing code. Anthropic disclosed the issue to OpenSSH, which addressed it in version 10.6; the company said about 20% of the code became unreachable to unauthenticated clients.

Anthropic says it plans to integrate a reusable Claude skill into its free, opt-in OSS-Scanner service. The skill will examine defaults, code reachable before security checks and conflicting settings. Findings will be checked through dynamic program tracing, and potentially disruptive changes will be left for human review.