Using Claude to reduce the attack surface of code — SkimNews
Get the Tech newsletter
Daily tech — startups, AI labs, chips, the launches that shape the next decade. Free.
- Anthropic ran Claude over 25 open-source projects totaling more than 5 million lines of code in C, C++, Java, PHP, and Python, cataloging 17,000 configuration options of which 3,842 were security-relevant.
- Claude identified 493 issues across three categories — default configuration exposure, configuration interaction conflicts, and early-reachability code — including 93 unnecessary pre-authentication surfaces in gated projects alone.
- Configuration interaction bugs were the most impactful findings: Claude found 162 security-sensitive option combinations accepted with no warning, with 94 of them silently turning off a security control.
- A hostname-vs-IP deny-list pattern surfaced independently in four unrelated projects, where DNS lookups disabled by default meant access-control rules could never fire and the lists would fail open.
- One conflicting configuration pair had coexisted in a project for 21 years — a certificate-required option was silently dropped when combined with another setting, exposing protected code paths to unauthenticated clients.
- OpenSSH showed the largest percentage reduction in attack surface after Claude's analysis, a result the authors flagged as 'surprising' for a high-quality C codebase.
Why it matters: The research reframes AI's defensive role: rather than chasing individual CVEs, Claude systematically mapped reachable code and configuration interactions, surfacing long-dormant flaws (including a 21-year-old bug) that traditional vulnerability scanners miss. Developers of the audited open-source projects gain a free, economically scalable audit of attack-surface exposure they can act on directly.
Ask SkimNews
.jpg)
