What was done
Anthropic ran its Claude models across 25 widely used open-source projects. The task was not classic bug hunting: it was finding code surfaces that attackers can reach when they should not be able to.
The results
Claude flagged 493 reachable surface issues in total. One of them had gone unnoticed inside the software for 21 years.
Why it matters
Open-source projects underpin a broad software ecosystem. Catching reachable surfaces early could offer broader protection than fixing individual bugs one by one. Anthropic's work offers a concrete example of how AI can be used in security auditing.
