Anthropic Uses Claude to Cut Code Attack Surfaces

Anthropic published research on using Claude to reduce the attack surface of software by mapping code that is reachable and then removing or restricting access to anything a deployment does not need to expose. The company said that finding and fixing individual vulnerabilities scales poorly, while reducing code reachability can lower the severity of unknown vulnerabilities, including ones under active exploitation, without having to find or fix each one.

Anthropic said it ran Claude over 25 open-source projects in a variety of languages, including C, C++, Java, PHP and Python, representing over five million lines of code. Claude discovered 493 issues and created an inventory of over 17,000 configuration options, of which 3,842 related to a security-relevant control or feature. The researchers grouped the projects into three categories: Public (10 projects serving any reachable user), Gated (11 projects serving authenticated users) and Private (4 projects serving the operator's own environment).

The study used three methods: default configuration, which looks for code reachable in the shipped default configuration that no default functionality intends to use; configuration interaction, which looks for pairs of options that are reasonable alone but cause problems together; and early reachability, which looks for security-sensitive or complex code that runs before an appropriate control such as authentication, or before a protocol state transition. Anthropic said all eleven Gated projects contained unintentionally reachable code, including 93 unnecessary pre-authentication surfaces in default configurations, 37 locations where code executed or state was recorded before authentication, and 61 configuration combinations that silently weakened a pre-authentication control.

For configuration interaction, Claude found 162 security-sensitive combinations accepted without an error, warning or documentation of their expected interaction. In 94 cases the combination silently turned off a security control, and 68 were inconsistencies in the same mechanisms. Claude also found one pattern in four unrelated projects: an access rule written with a hostname or wildcard pattern would never match an IP address when reverse DNS lookups were off, so a deny rule would never fire and the list would fail open. Another conflict in one project silently dropped a certificate-based identity check, letting unauthenticated clients reach request-handling code; the conflicting options had been present for 21 years.

In a case study of OpenSSH, Claude traced the SSH daemon in release 10.4 and found roughly 4,500 lines of new, experimental ML-DSA-44 post-quantum signature code that an unauthenticated client could reach in the default configuration, even though the algorithm was not enabled by default and was excluded when an administrator explicitly disabled it. Anthropic said those lines were about 16% of OpenSSH's pre-authentication code in a default sshd. The team reported the issue with patches; release 10.5 moved the check before parsing. Claude then identified two remaining gaps, including a mismatch between the advertised algorithm name and the key type actually parsed, and an ungated certificate CA signature path. A further fix placed the checks inside the parser, and the maintainers shipped the changes in version 10.6, removing roughly a fifth of the code an unauthenticated client could previously reach in a default build.

Anthropic has packaged the three methods into a reusable Claude skill that it is working to integrate into OSS-Scanner. The skill runs three passes, each starting with an empty context window except for a short piece of context from the prior pass, and confirms each finding with a dynamic trace of the program. For default-configuration findings, it designs and implements a gate and checks that the program's default behavior is unchanged by running the project's own tests.

Anthropic published research on using Claude to reduce the attack surface of software by mapping code that is reachable and then removing or restricting access to anything a deployment does not need to expose. The company said that finding and fixing individual vulnerabilities scales poorly, while reducing code reachability can lower the severity of unknown vulnerabilities, including ones under active exploitation, without having to find or fix each one.

Anthropic said it ran Claude over 25 open-source projects in a variety of languages, including C, C++, Java, PHP and Python, representing over five million lines of code. Claude discovered 493 issues and created an inventory of over 17,000 configuration options, of which 3,842 related to a security-relevant control or feature. The researchers grouped the projects into three categories: Public (10 projects serving any reachable user), Gated (11 projects serving authenticated users) and Private (4 projects serving the operator's own environment).

The study used three methods: default configuration, which looks for code reachable in the shipped default configuration that no default functionality intends to use; configuration interaction, which looks for pairs of options that are reasonable alone but cause problems together; and early reachability, which looks for security-sensitive or complex code that runs before an appropriate control such as authentication, or before a protocol state transition. Anthropic said all eleven Gated projects contained unintentionally reachable code, including 93 unnecessary pre-authentication surfaces in default configurations, 37 locations where code executed or state was recorded before authentication, and 61 configuration combinations that silently weakened a pre-authentication control.

For configuration interaction, Claude found 162 security-sensitive combinations accepted without an error, warning or documentation of their expected interaction. In 94 cases the combination silently turned off a security control, and 68 were inconsistencies in the same mechanisms. Claude also found one pattern in four unrelated projects: an access rule written with a hostname or wildcard pattern would never match an IP address when reverse DNS lookups were off, so a deny rule would never fire and the list would fail open. Another conflict in one project silently dropped a certificate-based identity check, letting unauthenticated clients reach request-handling code; the conflicting options had been present for 21 years.

In a case study of OpenSSH, Claude traced the SSH daemon in release 10.4 and found roughly 4,500 lines of new, experimental ML-DSA-44 post-quantum signature code that an unauthenticated client could reach in the default configuration, even though the algorithm was not enabled by default and was excluded when an administrator explicitly disabled it. Anthropic said those lines were about 16% of OpenSSH's pre-authentication code in a default sshd. The team reported the issue with patches; release 10.5 moved the check before parsing. Claude then identified two remaining gaps, including a mismatch between the advertised algorithm name and the key type actually parsed, and an ungated certificate CA signature path. A further fix placed the checks inside the parser, and the maintainers shipped the changes in version 10.6, removing roughly a fifth of the code an unauthenticated client could previously reach in a default build.

Anthropic has packaged the three methods into a reusable Claude skill that it is working to integrate into OSS-Scanner. The skill runs three passes, each starting with an empty context window except for a short piece of context from the prior pass, and confirms each finding with a dynamic trace of the program. For default-configuration findings, it designs and implements a gate and checks that the program's default behavior is unchanged by running the project's own tests.