Claude flags nearly 500 worrying open source security issues — C, Java, and Python code all at risk as one flaw wasn't spotted for 21 years

Anthropic's Claude AI analyzed 25 major open source projects written in C, C++, Java, PHP, and Python for security issues. It uncovered nearly 500 security problems, including exposed pre-authentication code paths, conflicting security settings, and flaws hidden for 21 years. Anthropic argues that searching for individual vulnerabilities is unfeasible, so instead recommends reducing the attack surface by limiting unnecessary code access.

The 25 projects analyzed contained over five million lines of code, with more than 17,000 configurable options. Researchers found 162 configuration combinations that were set without documentation explaining their behavior. OpenSSH was singled out as containing a daemon that could reach 4,500 lines of experimental code before authentication, even though that algorithm was disabled by default.

Anthropic disclosed its findings to OpenSSH, which released a fix in version 10.6. Anthropic plans to integrate this AI-powered security skill into its OSS-Scanner service to help developers systematically limit unnecessary code exposure.