Key points
- Anthropic’s Claude identified nearly 500 security issues across 25 open source projects written in C, Java, and other languages.
- The analysis revealed 93 pre-authentication attack surfaces and 61 configuration combinations that weakened security controls in default settings.
- The company argues that reducing unnecessary code exposure is more effective than hunting for individual vulnerabilities, citing one flaw hidden for 21 years.
Anthropic’s AI model, Claude, uncovered nearly 500 security issues in a recent analysis of 25 major open source projects. According to TechRadar, the scan targeted code written in C, C++, Java, PHP, and Python. The findings included exposed pre-authentication code paths, conflicting security settings, and vulnerabilities that remained undetected for decades. This report shifts focus from traditional vulnerability hunting to structural code exposure.
By the numbers
- Nearly 500 security issues were identified across the 25 analyzed open source projects.
- More than five million lines of code were scanned during the Anthropic research effort.
- 17,000 configuration options were inventoried, with 3,842 relating to security-relevant controls and features.
What the figures mean
The research indicates that traditional vulnerability hunting is insufficient for modern software security. Anthropic argues that looking for individual flaws is a Sisyphean task that scales poorly. Instead, the company suggests defenders should reduce software attack surfaces by restricting unnecessary access to potentially exploitable code. This approach aims to mitigate risks from unknown vulnerabilities that may already be in use.
The analysis focused on three specific ways code gets unnecessarily exposed. These include features accessible in default configurations when not needed, conflicting settings that erode security, and complex sensitive code running before security checks. The study found that all 11 projects designed for authenticated users contained code reachable when it should not have been. This highlights the prevalence of pre-authentication exposure in widely used software.
Specifically, the scan identified 93 pre-authentication attack surfaces in default configurations. It also found 37 instances of code executing before authentication and 61 combinations of configurations that eroded pre-authentication controls. In total, the projects contained 162 configuration combinations accepted without documentation explaining their behavior. In some cases, these settings disabled security controls entirely.
One notable finding was a configuration flaw that sat undetected for more than two decades. This long-hidden issue underscores the difficulty of manual code review and the potential value of AI-driven analysis. Anthropic states that reducing unnecessary attack surface lowers risk from all unknown vulnerabilities in that code simultaneously. This includes any flaws that are already being quietly exploited by threat actors.
What to watch
Security teams should monitor for updates regarding the 25 projects analyzed by Anthropic. While specific project names were not listed in the initial report, the affected languages include C, Java, and Python. Organizations using these open source components should review their configurations for the types of conflicts identified. Watch for vendor announcements about configuration hardening or code removal.
Infection and persistence in general
Teams usually assess how malware or vulnerabilities arrive through exposed code paths. Analysts examine default configurations to see if sensitive features are accessible without authentication. They check for conflicting settings that might inadvertently disable security controls. Persistence often relies on these pre-authentication gaps, allowing unauthorized access before identity verification. Reviewing complex code execution order helps identify unnecessary exposure.
Background: Configuration hardening
Configuration hardening is the process of securing a system by disabling unused features and enforcing strict settings. It reduces the number of entry points attackers can exploit. Start by turning off services you do not actively use. This limits exposure before software patches are available.
Read the full guide: Configuration Hardening: The Silent Defense Against N-Day Vulnerabilities
What to do and how to stay safe: Anthropic
- Review default configurations of open source components to ensure sensitive features are not accessible without authentication.
- Audit configuration combinations for conflicts that might erode or disable existing security controls.
- Identify and remove unnecessary code exposure to reduce the overall attack surface of your applications.
- Once the vendor provides an update, apply patches that address the specific configuration flaws identified in these projects.
Step-by-step guide: Patch Management Implementation: A Step-by-Step Rollout Plan
General security guidance from the Sandbox Gazette newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which programming languages were analyzed in this study?
The analysis covered projects written in C, C++, Java, PHP, and Python.
How many security issues did Claude find?
Claude identified nearly 500 security issues across the 25 projects.
What is Anthropic's recommended approach to security?
Anthropic recommends reducing software attack surfaces by restricting unnecessary access to code rather than hunting individual vulnerabilities.
