Claude identifies 493 security issues across 25 open-source projects
Over the past year, frontier AI models can discover vulnerabilities. This post by Chris Rohlf shows how Claude can be used for automated attack surface analysis and reduction. They ran Claude on 25 open‑source projects (covering over five million lines of code) and it flagged 493 issues.
Key points
- Claude flagged 493 issues in 25 open‑source projects covering over five million lines of code.
- In eleven gated projects Claude found 93 pre‑auth surfaces, 37 early‑execution spots, and 61 weakening configuration combos.
- OpenSSH 10.4 exposed ~4,500 lines (≈16 % of pre‑auth code); fixes in 10.6 reduced reachable code by about a fifth.
The analysis used three methods—default‑configuration reachability, configuration‑interaction conflicts, and early‑reachability before authentication. In the eleven gated projects Claude found 93 unnecessary pre‑auth surfaces, 37 early‑execution spots, and 61 config combos that weakened controls. Across all projects it identified 162 risky configuration combinations, 94 of which silently disabled a security control.
A detailed case study on OpenSSH showed roughly 4,500 lines (about 16 % of pre‑auth code) reachable in version 10.4, leading to patches that were shipped in version 10.6 and cut the reachable code by about a fifth. The authors packaged the three passes into a reusable Claude skill intended for integration with OSS‑Scanner.
Using Claude to reduce the attack surface of code
anthropic.com · 21 October 2026
Loading the full article…
This text was published by anthropic.com and written by Anthropic. It is reproduced here with attribution so you can read it in full; the rights remain with the publisher. Read it at the source ↗
Coverage and discussion
1source- Hacker News discussion · 46 pointsnews.ycombinator.com
The headline, key points and digest above were generated by Digest AI's editorial model from the linked sources. Automated summaries can contain errors: the sources are the record. Spotted a mistake? Tell us. Published by Martin K., who runs Digest AI and handles corrections.
More in Agents & Tools
All →- Google rolls out Personal Intelligence for Gemini in cars starting with Android Auto · 6 src
- Mistral AI launches Voxtral 3 voice agent stack · 2 src
- DeepSeek launches Search and Fetch APIs at $0.75 per 1,000 requests and releases DeepSeek-V4.1-Flash-1017 model · 6 src
- Researchers introduce M-Plan framework for LLM agents with memory arrangement · 3 src
- SPEM framework improves skill use in LLM agents · 1 src
Comments
via GitHub Discussions