Claude found 493 security flaws in 25 open-source projects without fixing a single bug
Using Claude to reduce the attack surface of code
Anthropic researchers ran Claude over 25 open-source projects—over five million lines of C, C++, Java, PHP, and Python—to map reachable code and flag unnecessary exposure. The model surfaced 493 issues, including 162 dangerous configuration combinations and 93 pre-authentication surfaces in gated projects. In OpenSSH, it traced 4,500 lines of post-quantum signature code reachable by unauthenticated clients, leading to a fix that removed roughly a fifth of the daemon's pre-auth attack surface.
Minimizing codebases' attack surface results in better security without ever having to find or fix an individual vulnerability.