Claude flags nearly 500 worrying open source security issues C, Java, and Python code all at risk as one flaw wasn't spotted for 21 years

Date:
Thu, 22 Oct 2026 18:35:00 +0000

Description:
Hunting for individual vulnerabilities will get us nowhere, Anthropic argues. Instead, businesses should reduce accessible code.

FULL STORY ======================================================================Copy link Facebook X Whatsapp Reddit Pinterest Flipboard Threads Email Share this article 0 Join the conversation Follow us Add us as a preferred source on Google Newsletter Subscribe to our newsletter Anthropic used Claude to
analyze 25 open source projects and uncovered nearly 500 security issues Research found exposed pre-authentication code paths, conflicting security settings, and long-hidden flaws AI identified attack-surface reductions that removed unnecessary code exposure before vulnerabilities could be exploited Anthropic recently used Claude to analyze 25 major open source projects written in C, C++, Java, PHP, and Python, in search of security issues. It found almost 500 of them, including security controls turned off by conflicts in settings, sensitive code accessible before authentication, and even a vulnerability that sat in the code for 21 years.

This wasnt a standard hunt for vulnerabilities. In its report , Anthropic argues that looking for individual vulnerabilities is a Sisyphean task that scales poorly and never guarantees security. Instead, it thinks defenders should turn towards reducing software attack surfaces by restricting unnecessary access to potentially exploitable code. A defender who reduces unnecessary attack surface in their code reduces the risk from all of the unknown vulnerabilities in that code at onceincluding any that are already being quietly exploited, Anthropic said. Latest Videos From TechRadar Watch full video here:

The 25 projects it scanned contained more than five million lines of code. Claude created an inventory of more than 17,000 configuration options, 3,842 of which related to security-relevant controls and features. Misconfigured security controls The companys research focused on three ways code may get unnecessarily exposed: features accessible in the default configuration when theyre not needed, different settings which, when combined, erode security, and unnecessarily complex and sensitive code running before security checks. You may like Anthropic reveals Claude AI model hacked three companies during tests so how worried should we be? White hat hackers just breached OpenAI using Anthropic's Claude in less than 72 hours and it is a case study in
just how fast AI is advancing Companies need to focus on fixing exploitable vulnerabilities, not discovering as many as possible

The analysis showed all 11 projects, which were designed to serve authenticated users, contained code that was reachable when it shouldnt have been. These include 93 pre-authentication attack surfaces in default configurations, 37 instances of code executing before authentication, and 61 combinations of different configurations that eroded pre-authentication controls.

In total, the 25 analyzed projects contained 162 configuration combinations that were accepted without their documentation explaining how they were supposed to behave. In some cases, security controls were being disabled. In others, there were various inconsistencies and problems. Are you a pro? Subscribe to our newsletter Sign up to the TechRadar Pro newsletter to get
all the top news, opinion, features and guidance your business needs to succeed! Contact me with news and offers from other Future brands Receive email from us on behalf of our trusted partners or sponsors By submitting
your information you agree to the Terms & Conditions and Privacy Policy and are aged 16 or over.

One configuration flaw was sitting undetected for more than two decades, Anthropic found. While one setting made clients prove their identity through certificates, another one disabled it entirely (even though it was designed
to delay the check, not kill it). Even though these were conflicting options, they were accepted without warning. OpenSSH exposed thousands of lines of
code Anthropic singled out OpenSSH as its case study for the report. The software, widely used to provide secure remote access, contained a daemon
that could reach 4,500 lines of experimental code that implements a post-quantum signature algorithm before checking if it was permitted by the servers configuration to begin with.

As it turned out, the algorithm was disabled by default, but its parsing code was accessible to unauthenticated clients. Anthropic disclosed its findings
to OpenSSH, who came back with a fix in version 10.6, in which some 20% of
the code was now unreachable by unauthenticated clients. What to read next In open source cybersecurity, AI is kind of a problem but it can also be a solution AI is changing security testing, but not all vulnerabilities are created equal Why AI coding is widening the software security gap

The company said it combined these techniques into a reusable Claude skill which will soon be integrated into OSS-Scanner, its free, opt-in security scanning service for open-source projects. The skill will examine default configurations, code that is reachable before security checks, as well as settings configurations that are in conflict with one another.

Anthropic added that the system will validate the findings through a dynamic program tracing, and will test proposed changes against existing behavior. Potentially disruptive changes will be left for humans to review.

It is perhaps impossible to measure how many unknown vulnerabilities are in any given codebase, the researchers concluded. And there is plenty of data that shows attackers can and will find those vulnerabilities with enough time (particularly if equipped with frontier AI models). Therefore, AI could help developers systematically limit unnecessary exposure, making software that much harder to attack. The best antivirus for all budgets Our top picks,
based on real-world testing and comparisons

Read our full guide to the best antivirus 1. Best overall: Bitdefender Total Security 2. Best for families: Norton 360 with LifeLock 3. Best for mobile: McAfee Mobile Security Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds.



======================================================================
Link to news story: https://www.techradar.com/pro/security/claude-flags-nearly-500-worrying-open-s ource-security-issues-c-java-and-python-code-all-at-risk-as-one-flaw-wasnt-spo tted-for-21-years


--- Mystic BBS v1.12 A49 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)