Claude points out nearly 500 worrying open source security issues: C, Java and Python codes at risk as a flaw went undetected for 21 years
follow us
Add us as a preferred source on Google
- Anthropic used Claude to analyze 25 open source projects and discovered almost 500 security issues.
- Investigation found exposed pre-authentication code paths, conflicting security configurations, and long-hidden flaws
- AI identified reductions in the attack surface that eliminated unnecessary code exposure before vulnerabilities could be exploited.
Anthropic recently used Claude to analyze 25 major open source projects written in C, C++, Java, PHP, and Python, for security issues. It found nearly 500 of them, including security controls disabled due to configuration conflicts, sensitive code accessible before authentication, and even a vulnerability that remained in the code for 21 years.
This was not a standard vulnerability search. In its report, Anthropic argues that searching for individual vulnerabilities is a Sisyphean task that scales poorly and never guarantees security. Instead, he believes defenders should focus on reducing software attack surfaces by restricting unnecessary access to potentially exploitable code.
“A defender that reduces the unnecessary attack surface in your code reduces the risk of all unknown vulnerabilities in that code at once, including those that are already being silently exploited,” Anthropic said.
Latest videos ofTechnologyRadar
The 25 projects he scanned contained more than five million lines of code. Claude created an inventory of more than 17,000 configuration options, 3,842 of which were related to security-relevant controls and features.
Misconfigured security controls
The company’s investigation focused on three ways code can be unnecessarily exposed: functions accessible in the default configuration when they are not needed, different configurations that, when combined, erode security, and unnecessarily complex and sensitive code that runs before security checks.
The analysis showed that the 11 projects, which were designed to serve authenticated users, contained accessible code when it should not have been. These include 93 pre-authentication attack surfaces in default configurations, 37 code instances running before authentication, and 61 combinations of different configurations that eroded pre-authentication controls.
In total, the 25 projects analyzed contained 162 configuration combinations that were accepted without their documentation explaining how they were supposed to behave. In some cases, security controls were being disabled. In others, there were various inconsistencies and problems.
Anthropic discovered that a configuration defect remained undetected for more than two decades. While one setting made clients prove their identity via certificates, another disabled it entirely (even though it was designed to delay verification, not cancel it). Although these were contradictory options, they were accepted without prior notice.
OpenSSH exposed thousands of lines of code
Anthropic highlighted OpenSSH as its case study for the report. The software, widely used to provide secure remote access, contained a daemon that could reach 4,500 lines of experimental code implementing a post-quantum signature algorithm before checking whether it was allowed by the server configuration to begin with.
As it turned out, the algorithm was disabled by default, but its analysis code was accessible to unauthenticated clients. Anthropic revealed its findings to OpenSSH, who returned with a fix in version 10.6, in which around 20% of the code was now inaccessible to unauthenticated clients.
The company said it combined these techniques into a reusable Claude skill that will soon be integrated into OSS-Scanner, its free and optional security scanning service for open source projects. The skill will examine default settings, code that can be accessed before security checks, as well as settings that conflict with each other.
Anthropic added that the system will validate findings through dynamic program monitoring and test proposed changes against existing behavior. Potentially disruptive changes will be left for humans to review.
“It may be impossible to measure how many unknown vulnerabilities there are in a given code base,” the researchers concluded. “And there is plenty of data showing that attackers can and will find those vulnerabilities given enough time (especially if they are equipped with cutting-edge AI models).” AI could therefore help developers systematically limit unnecessary exposure, making software much more difficult to attack.
The best antivirus for all budgets
Follow TechRadar on Google News and add us as a preferred source to receive news, reviews and opinions from our experts in your feeds.
Post Comment