Anthropic used Claude to examine 25 open-source projects, whose code is publicly available. Rather than searching only for individual bugs, the team looked for code that users could reach unnecessarily. Claude flagged 493 issues after examining more than five million lines of code. One issue had existed for 21 years: two conflicting settings allowed any client to connect to a server that should have accepted only trusted clients. In OpenSSH, which protects remote computer access, Claude found code reachable before login even when an administrator had excluded the relevant feature. Developers released fixes. This approach makes hidden weaknesses harder to reach, but does not remove them.
In a separate effort with software verification company Theorem, Anthropic used Claude to check specific safety rules in 123 software libraries, collections of code used by other programs. Claude turned existing automated tests into mathematical descriptions and generated proofs covering 239 program entry points. These showed that the code would not crash under defined conditions. Another tool, Rocq, checked the proofs. The process also uncovered hundreds of bugs, including problems that had survived years of testing. However, a mathematical proof is not a guarantee that software has no bugs. Its protection depends on the particular rules, inputs, and assumptions it covers.
