Anthropic uses Claude AI to identify security vulnerabilities in open source projects

Anthropic has released details regarding the use of its Claude AI model to enhance cybersecurity through codebase scanning and attack surface reduction. In a research initiative, Claude analyzed over 5 million lines of code across 25 open-source projects, identifying 493 potential security issues.

The analysis focused on reducing the attack surface by identifying non-essential code that remains exposed and detecting configuration interactions that weaken security. Notably, the AI discovered a 21-year-old vulnerability involving conflicting parameters that could allow unauthenticated connections to a server. In the case of OpenSSH, Claude identified approximately 4,500 lines of experimental code related to a post-quantum algorithm that remained accessible to unauthenticated clients despite being disabled.

Anthropic is also introducing Claude Security, a feature currently in public beta for Enterprise plans. This tool provides continuous repository scanning, tracks findings through to remediation, and suggests patches for human review. The service is designed to integrate into existing developer workflows by explaining vulnerable paths and reducing triage workloads, though Anthropic emphasizes it is an additional review layer rather than a replacement for manual code reviews or incident response.