Anthropic's Claude Finds Nearly 500 Flaws in 25 Open Source Projects

Anthropic has published research in which its Claude model analyzed 25 major open source projects and uncovered almost 500 security issues, according to TechRadar. The projects, written in C, C++, Java, PHP and Python, contained more than five million lines of code.

Claude inventoried more than 17,000 configuration options across the codebases, of which 3,842 were security-relevant. All 11 projects designed to serve authenticated users contained code reachable when it should not have been, the research found.

The analysis identified 93 pre-authentication attack surfaces in default configurations, 37 instances of code executing before authentication and 61 configuration combinations that eroded pre-authentication controls. It also found 162 configuration combinations accepted without documentation explaining their intended behavior, and one configuration flaw that went undetected for more than two decades.

OpenSSH served as a case study: its daemon could reach 4,500 lines of experimental post-quantum signature algorithm code before checking whether server configuration permitted it. OpenSSH has since released a fix in version 10.6 that made about 20% of the code unreachable by unauthenticated clients.

A reusable skill for OSS-Scanner

Anthropic said it combined the techniques into a reusable Claude skill to be integrated into OSS-Scanner, its free opt-in security scanning service for open source projects. The skill will validate findings through dynamic program tracing and test proposed changes against existing behavior, leaving potentially disruptive changes for human review.