Rather than chasing the flaws one by one, Anthropic has Claude map the unnecessarily exposed code. Out of more than 5 million lines, 493 problems have been identified.
Anthropic presents an initial assessment of its work on automated analysis and reduction of the attack surface. The idea: instead of correcting each vulnerability discovered, have the model identify the code that is unnecessarily accessible — before authentication, without user action, activated by default — and then place it behind a suitable barrier. An unknown flaw thus becomes more difficult to reach, even if it has never been found.
Settings that silently disable security
Claude reviewed 25 open source projects in C, C++, Java, PHP, and Python, totaling more than five million rows. He inventoried more than 17,000 configuration options, 3,842 of which were security-related, and identified a total of 493 issues. The eleven projects that were supposed to be protected by authentication all exposed code that was unintentionally accessible: 93 unnecessary surfaces before authentication in the default configuration, 37 places where code runs before identification, 61 combinations that weaken a control chosen by the administrator.
The most striking results were in the interactions between settings: 162 sensitive combinations accepted without warning or documentation, 94 of which cut off protection altogether. In one project, two seemingly compatible options removed the requirement for a client certificate, and this contradiction had existed for 21 years. Anthropic says that none of these issues were exploitable on their own, but they expanded exposure far beyond what was necessary.
Read the full article on the original source
Go to the source →