---
title: "Anthropic’s Claude flags 493 security risks in open-source projects"
description: "Anthropic’s Frontier Red Team used Claude to review 25 large open-source projects, more than five million lines of code."
author: Graham
date: 2026-10-20
url: https://powerofai.ca/news/2026-10-20-anthropic-claude-open-source-security-review
---

# Anthropic’s Claude flags 493 security risks in open-source projects

Anthropic’s Frontier Red Team used Claude to review 25 large open-source projects, more than five million lines of code.

October 20, 2026 · Learning

Anthropic’s Frontier Red Team used Claude to review 25 large open-source projects, more than five million lines of code. Claude flagged 493 issues, mostly risky default settings and code that runs before a user logs in, rather than confirmed bugs. In OpenSSH, the tool many servers use for secure remote access, it found about 4,500 lines of experimental code reachable without logging in. Anthropic worked with the OpenSSH developers on fixes, which shipped in version 10.6. Anthropic plans to add the method to a free opt-in scanning service for open-source projects.

**Why it matters to you:** Most websites and businesses quietly depend on open-source software. AI that finds risky settings at this scale can close holes before attackers find them.

**Try this:** Run a quick security check on the settings you control.

> I run a small business website on [platform, e.g. WordPress or Shopify]. List the 10 most important security settings I should check, what a safe setting looks like for each, and how to find it.

Source: [Anthropic](https://www.anthropic.com/research/attack-surface-reduction)

## More from Today in AI

- [New York City proposes rules to end AI customer service doom loops](/news/2026-10-20-nyc-ai-chatbot-doom-loops-rule) · October 20, 2026
- [SpaceX’s AI business now earns more than Starlink, Q3 results show](/news/2026-10-20-spacex-ai-revenue-passes-starlink) · October 20, 2026
- [Claude designs proteins that bind scorpion toxins in Anthropic test](/news/2026-10-20-claude-scorpion-antivenom-binders) · October 20, 2026
- [WhatsApp help pages hid AI instructions not to mention regulators](/news/2026-10-19-whatsapp-hidden-ai-instructions) · October 19, 2026
- [EU publishes first AI Act standard, EN 18286 for quality management](/news/2026-10-19-eu-ai-act-first-standard-en-18286) · October 19, 2026

[All of Today in AI](/the-signal/today). [Where AI is heading](/the-signal/horizon).