Anthropic Finds 94 Cases Where Open-Source Projects Drop Security Controls Without Warning
Help Net Security, Thursday, October 22nd, 2026
Anthropic's red team found unnecessary exposure, weakening config combos and pre-auth code paths across 25 open-source projects.
Anthropic's Frontier Red Team used Claude to examine 25 open-source projects for attack surface reduction issues and reported 493 findings.
It looked at code reachable under default settings despite serving no default purpose, setting combinations that weaken protections, and complex code that runs before security checks.
All 11 projects meant to restrict features to authenticated users had code reachable before authentication, and 94 cases involved security controls silently dropping.
Anthropic says most findings were not exploitable alone but widened attack surface, and argues developers should restrict unneeded features and move checks earlier.