Anthropic uses Claude to reduce the attack surface of 25 open-source projects and finds 493 issues

Anthropic has put Claude, its AI model, to work reviewing open-source code to reduce what is left exposed to attackers. The company's Frontier Red Team explained it on Tuesday, October 20, in an article signed by Chris Rohlf.

In initial research, the company applied Claude to 25 open-source projects, with more than five million lines written in languages such as C, C++, Java, PHP and Python. It found 493 issues. The method, which they call attack surface reduction, is about locating code that can be reached with no need and placing it behind a barrier, such as authentication or an option that has to be switched on on purpose.

Anthropic looked for three kinds of problem: code reachable with the factory settings even though no intended feature uses it; pairs of options that seem sensible separately and cause failures together, and sensitive code that runs ahead of a control such as authentication. Claude took stock of more than 17,000 configuration options across those projects; 3,842 had to do with security.

Of the 25 projects, 10 are meant for any user, 11 for authenticated users and 4 for the private environment of whoever installs them. In the eleven projects for authenticated users, Claude found code that could be reached unintentionally, although in each one it was only a small share of the total. That included 93 needless surfaces reachable before authentication with the default settings. According to Anthropic, they could not be exploited right away on their own, but they leave more attack surface than necessary.

Across the projects as a whole, Claude found 162 combinations of security options that the program accepted with no error, no warning and no documentation of their effect; in 94 of them, the combination silently disabled a security control. The same pattern showed up in four unrelated projects: access rules written with machine names that, with reverse DNS lookups switched off, could never match the client's IP address, so a rule meant to deny access never actually applied. In another case, two conflicting options cancelled the requirement for clients to present a certificate, and that combination had been in the program for 21 years.

The biggest cut relative to the size of the code came in OpenSSH, the secure remote access program. In its 10.4 release, a client without authentication could reach, with the default settings, roughly 4,500 lines of new, experimental code for ML-DSA-44, a post-quantum signature algorithm, even though it was not switched on and even if the administrator excluded it. That is roughly 16% of the OpenSSH code that runs before authentication. Anthropic notified its developers with patches and release 10.5 moved the check earlier; Claude then found two gaps in it, and the final fix, shipped in release 10.6, removed roughly a fifth of the code an unauthenticated client could previously reach.

Anthropic has bundled these techniques into a reusable Claude skill that it is building into OSS-Scanner. It makes three passes over the code, confirms each finding by tracing how the program runs and, when it proposes a barrier, runs the project's own tests to check that the default behavior does not change; anything that would affect other configurations is left for a person to decide. The company gives no date for that integration.