Claude found 493 problems in 25 open-source projects, including a setting that silently disabled client certificate checks for 21 years
Prepared by Sintelligent with the help of SI. Published in SI: . Updated: .
SI can not only find bugs in code but also remove unnecessary "doors" in settings, and developers are already accepting such fixes.
In an Anthropic study, Claude reviewed more than 5 million lines of C, C++, Java, PHP and Python code in 25 projects and looked for ways to reduce the attack surface: unnecessary exposure in default settings, conflicting parameters, and code that runs before permission checks. Of more than 17,000 parameters, 3,842 are security-related; 162 problems were found in how settings interact, and in 94 cases one parameter silently disabled a protective one. In OpenSSH, Claude pointed to about 4,500 lines of experimental ML-DSA signature parsing reachable by unauthenticated clients; the fixes went into version 10.6. Anthropic notes that on their own the findings would not be immediately exploitable, and that results varied noticeably across categories of projects.
Sources 2