Three methods, 25 projects

Claude looked for three kinds of exposure: code reachable in the shipped default configuration that no default feature uses; pairs of options that are fine alone but cause problems together; and complex, security-sensitive code that runs before a control such as authentication. Anthropic ran this over 25 open-source projects with over five million lines of code in languages including C, C++, Java, PHP and Python. Claude listed over 17,000 configuration options, 3,842 of them security relevant, and found 493 issues.

What Claude found

  • All 11 projects meant to serve only authenticated users had code that was reachable without intent: 93 unnecessary pre-authentication surfaces in default configurations, 37 places where code ran or state was recorded before authentication, and 61 configuration combinations that silently weakened an administrator's pre-authentication control.
  • 162 security-sensitive configuration combinations were accepted with no error or warning and no documentation. In 94 cases the combination silently turned off a security control.
  • In four unrelated projects, a deny rule written with a hostname never fired when reverse DNS lookups were off, so the list failed open.
  • In one project, an option meant to delay a client certificate check actually disabled it, letting any client reach request handling code meant to sit behind the check. The conflict had been in the software for 21 years.

OpenSSH

The largest reduction, as a share of code, came in OpenSSH. In release 10.4, roughly 4,500 lines of experimental ML-DSA-44 signature code could be reached by an unauthenticated client in the default configuration, even when an administrator excluded the algorithm. That was about 16% of a default sshd's pre-authentication code. After fixes worked out with the maintainers, the allow-list checks now run before parsing and signature verification, removing roughly a fifth of the code an unauthenticated client could previously reach. The changes shipped in OpenSSH 10.6.

What comes next

Anthropic has combined the methods into a Claude skill that runs three passes over a codebase and confirms each finding with a dynamic trace. Anthropic says it is working to add the skill to OSS-Scanner, its opt-in vulnerability-finding service for open-source projects, and did not give a date. Gates that would change non-default behavior are left for a human to decide.

The work sits on the defensive side of AI security testing; for the offensive side, see our report on how DeepSeek V4.1 Flash 1017 beat GPT-6 Sol in Vals AI's offensive cyber test. For Claude's built-in code checks for teams, see what Claude Code Review costs on Team and Enterprise plans.