Anthropic uses Claude to find 493 attack surface issues

Anthropic says in a company research post that Claude found 493 attack surface issues across 25 open source projects containing more than five million lines of code. The model inventoried over 17,000 configuration options, including 3,842 tied to security controls or features.

All 11 projects designed for authenticated users contained unintentionally reachable code. Claude identified 93 unnecessary surfaces reachable before authentication, 37 cases where code ran or recorded state before authentication, and 61 configuration combinations that weakened controls. Across all projects, it found 162 undocumented combinations involving security settings, including 94 that silently disabled a control.

In OpenSSH 10.4, Claude found about 4,500 lines of ML-DSA-44 signature code that unauthenticated clients could reach even when the algorithm was disabled. Further analysis identified gaps in an initial fix, including paths involving false key type claims and certificate authority signatures. OpenSSH 10.6 added checks inside the parser, removing roughly one fifth of the code previously reachable by unauthenticated clients in a default build.

Anthropic combined the methods into a reusable Claude skill that it plans to integrate into OSS-Scanner. The skill checks default configurations, code reachable before authentication or protocol entry points, and combinations of settings that silently weaken security controls.