Anthropic runs Claude over 25 open-source projects, finds 493 attack-surface issues

Anthropic Research · rss · 2026-10-20

Anthropic's Frontier Red Team published research on automated attack surface analysis and reduction: instead of finding individual vulnerabilities, use Claude to map reachable code and move unnecessary exposure behind gates—reducing the severity of unknown vulnerabilities without ever fixing them.

Methods: three classes of issues—default-configuration reachability, configuration interaction (pairs that silently disable security controls), and early reachability (code running before authentication or protocol state transitions).

Results: analyzing 25 open-source projects (5M+ lines in C, C++, Java, PHP, Python), Claude inventoried 17,000+ configuration options (3,842 security-relevant) and found 493 issues:

All 11 gated (auth-protected) projects had unintentionally reachable code: 93 unnecessary pre-auth surfaces in default configs, 37 pre-auth executions, and 61 config combinations silently weakening pre-auth controls.
162 security-sensitive config combinations accepted without warning or documentation; 94 silently turned off a security control, 68 were mechanism inconsistencies (e.g., a listener remaining reachable despite being "disabled").
One antipattern appeared independently in 4 unrelated projects: hostname/wildcard access rules that fail when reverse DNS lookups are disabled.

Anthropic argues attack-surface reduction meaningfully improves deployed software security economically, and developers can apply the same techniques to their own code.

Original post →

Anthropic runs Claude over 25 open-source projects, finds 493 attack-surface issues

More from coding & agent