Claude finds 493 security issues in open source

Anthropic said it was testing automated attack-surface analysis and reduction with Claude, using the model to map reachable code and then limit access to code a deployment did not need. It said it applied the method to 25 open-source projects and organised the results into public, gated and private categories.

The company said Claude found unintentional reachability in all eleven gated projects. It also said it identified 162 security-sensitive configuration combinations that were accepted without warning, 94 of which turned off a security control.

Anthropic said one pattern appeared in four unrelated projects, where hostname-based deny rules failed open if reverse DNS lookups were disabled. It also said a separate configuration conflict had been present for 21 years and could leave a server accepting connections it was supposed to reject.

In its OpenSSH case study, Anthropic said Claude traced the SSH daemon in version 10.4 and found roughly 4,500 lines of pre-authentication ML-DSA-44 code reachable even when the algorithm was not enabled. It said it reported the issue with patches, after which version 10.5 moved the check before parsing, but it later found two gaps in that fix and built a proof of concept before working through further changes with maintainers.