Claude finds 493 bugs in 25 open‑source projects (5 M+ lines of C, C++, Java, PHP, Python); one flaw missed for 21 years (Chris Rohlf/Anthropic)
anthropic claude open-source
| Source: Techmeme | Original article
Claude identified 493 security flaws in 25 open‑source projects spanning over 5 million lines of C, C++, Java, PHP and Python code, including one issue that had gone undetected for 21 years.
Anthropic’s Claude has identified 493 security weaknesses across 25 open‑source projects that together contain more than five million lines of C, C++, Java, PHP and Python code, the company’s Frontier Red Team reported. The audit, led by security researcher Chris Rohlf, produced an inventory of over 17,000 configuration options, of which 3,842 relate to controls or features that affect security. Among the flagged items were 162 dangerous configuration combinations and 93 code paths reachable before authentication, including a stretch of 4,500 lines of post‑quantum signature code in OpenSSH that could be accessed without proper credentials. One of the discovered flaws had gone unnoticed for 21 years, underscoring how legacy code can harbor hidden risks.
The findings reinforce a growing narrative that frontier AI models are now capable of performing large‑scale code audits that were previously the domain of specialized security teams. By surfacing misconfigurations and premature exposure points, Claude can help maintainers shrink the attack surface of critical software, potentially lowering the cost and time required for vulnerability discovery. The study builds on our earlier coverage of Anthropic’s “Using Claude to reduce the attack surface of code,” which first detailed the methodology behind the analysis.
Looking ahead, the security community will watch for how quickly developers integrate Claude‑driven checks into continuous‑integration pipelines and whether other AI providers release comparable tooling. Anthropic’s next steps—whether to open the model for broader public use or to partner with open‑source foundations—could shape the pace at which AI‑assisted code hardening becomes a standard practice.
Sources
Back to AIPULSEN