Anthropic uses Claude to shrink attack surface in open-source code
Original title: Using Claude to reduce the attack surface of code
Claude reported 493 issues across 25 projects and more than five million lines of code.
Anthropic researcher Chris Rohlf describes early work using Claude to map reachable code and restrict features a deployment does not need. The team applied three methods—default configuration, configuration interaction, and early reachability—to 25 open-source projects in C, C++, Java, PHP, and Python. Anthropic says the approach can lower the severity of unknown vulnerabilities without finding or fixing each one, and discusses how developers might apply it.
Unconfirmed: The post is Anthropic's own research preview and is cut off before full issue details.
- Claude inventoried over 17,000 configuration options, 3,842 of them security relevant.
- All 11 gated projects had unintentionally reachable code, Anthropic says.
- It reported 93 unnecessary pre-authentication surfaces in gated projects' defaults.
- It also reported 37 pre-authentication execution or state sites and 61 weakening option pairs.
- Projects were grouped as public, gated, or private to interpret reachability.
From the original article
11 min read at anthropic.com
Over the past year, we’ve published lots of data that shows that frontier AI models are more than capable of discovering and exploiting security vulnerabilities. Showing how previously unknown vulnerabilities might be exploited is, however, only the start of what frontier AI models can do for cyber defense.
By dnw · anthropic.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.