Anthropic applies Claude to security

Anthropic is looking at a different way to use Claude for software security. Instead of only searching for individual bugs, it used the model to find code that a deployed system can reach but doesn’t need to expose. That code can then be moved behind a control such as authentication or an explicit opt-in. The approach doesn’t remove unknown vulnerabilities, Anthropic says, but can make them harder to reach and reduce their severity. Anthropic’s report describes the work.

The company tested Claude on 25 open-source projects, covering more than five million lines of code, and says it found 493 issues. These included settings that could silently weaken security controls, and code that ran before authentication. The findings are from Anthropic’s research, not a claim that Claude has secured these projects or that every issue is exploitable. The practical point for a business is that reviewing individual bugs may miss risky combinations of settings or features that are exposed unnecessarily.

For companies running software they didn’t build, this suggests a useful question for security reviews: what parts of the system are reachable by default, and should they be? Anthropic encourages organizations to explore using Claude to analyze and reduce the attack surface of software they depend on.