Anthropic used Claude to examine 25 open-source projects, whose code is publicly available, and identified 493 issues involving unnecessary access to code. Rather than simply finding individual bugs, the project focused on reducing the code that potential attackers could reach. One conflict between settings had existed for 21 years: a setting intended to delay an identity check actually disabled it, allowing anyone to connect.
In OpenSSH, which protects remote connections to computers, Claude identified roughly 4,500 lines of code that users could reach before proving their identity. This remained possible even when an administrator had excluded the relevant security algorithm. OpenSSH’s maintainers released fixes. Anthropic says reducing access can limit the danger from unknown flaws, but does not eliminate them.
In a separate effort with software verification company Theorem, Anthropic used Claude to check 123 software libraries through mathematical proofs. Claude converted existing automated tests into precise rules, then generated proofs that 239 program entry points would not crash under defined conditions. A separate tool, Rocq, checked those proofs. The process uncovered hundreds of bugs, including some that had survived years of testing. Claude also fixed bugs and produced new proofs for the updated code. However, the guarantees apply only to the properties and conditions covered by each proof; they do not establish that the software is entirely free of bugs.
