Member of Technical Staff @AnthropicAI on our Frontier Red Team. Local policy nerd. Fan of lists of three. I am P-unit or Pun-it, depending on the day.
The 505, San Francisco, beyond
Joined December 2008
- Tweets944
- Following392
- Followers744
- Likes54
Punit Shah retweeted
Reducing the attack surface of deployed services and apps is a fundamental component of software that is secure by design. Earlier this year we tasked Claude with autonomously mapping and reducing the attack surface of 25 large and widely used OSS codebases. This blog post covers some of our methodology and a preview of the data we collected.
This research resulted in a significant reduction in OpenSSH pre-authentication attack surface (now fixed in 10.6). And over 500 findings where reachability could be reduced and configurations hardened to ensure security controls weren’t silently disabled.
anthropic.com/research/attac…
11 days ago, our team @AnthropicAI launched OSS Scanner to give open source projects free, periodic vulnerability scans from our strongest models, inspired by OSS-Fuzz. Some numbers so far:
• ~650 projects applied
• 114 accepted
• 77 critical and 803 high model-rated findings reported (we haven’t scanned all projects yet)
How our reports ended up flagged as malware, and other learnings/updates below 🧵
An unexpected learning: it turns out emailing vulnerability proof-of-concepts (PoCs) gets your email rejected, so most of the reports we first sent bounced. We think mail filters flagged these PoCs as malware. We already sent encrypted reports when maintainers provided us a key. Now, all reports arrive encrypted.
OSS Scanner gives qualifying OSS projects PoCs and a suggested patch.
Updates:
• We’re piloting delivery through GitHub Security Advisories, which was a top request.
• We also made the FAQ's acceptance criteria clearer (most common rejection reasons: non-open-source license, projects that aren’t sufficiently established or critical), and we're working through the backlog.
Maintainers can apply for free: red.anthropic.com/oss-scanne…
How else can we make this more useful?
Proud to work at a place that stands up for democratic values 🇺🇸
A statement on the comments from Secretary of War Pete Hegseth.
anthropic.com/news/statement…
The consensus is 2025 is the "year of AI agents," yet there's no consensus on what an agent is.
But the definition doesn't really matter. What people really mean is: 2025 is when AI creates real value for users and businesses.
It's not just telling you cool things in Mexico, but it books your trip.
It's not just telling you how to debug some code, but actually making the change and finding other bugs proactively.
Today, you can build + publish Coda Packs, extensions that add new powers to your doc. Huge 👏🏽 to our early partners who inspired us by their creativity and passion passion for solving users' problems via Packs. Stories in the thread...
Big news: we’re pleased to introduce the all-new Coda 3.0 — the doc that brings it all together.
With a brand new editor, an open Packs platform, and hundreds of your most requested updates, Coda 3.0 is ready for your team.
Read more about Coda 3.0:
bit.ly/3dot0-t
And... you can do amazing things with Packs from brands you know like Gmail, Slack, Jira and more to create and see your team's tasks into your doc, share updates with the click of a button, and more
coda.io/gallery?filter=Packs
Excited to celebrate this with the 45+ Codans who worked on this. It's so easy to create a Pack because of their work. It's a privilege to get to product lead this journey with such a talented (and nice!) team. Join this great team—we're hiring! :)
grnh.se/15ac38072us
Punit Shah retweeted
Coda’s new features take on Microsoft Word and Google Docs f-st.co/YI0FADW
Launching custom Packs today, our take on plugins. Build in your browser in mins to connect data or bring custom formulas/templates to your doc—and share them in our Gallery. Huge kudos to great team 👏🏽 and the opportunity to product lead it coda.io/packsbeta
You’re unable to view this Post because this account owner limits who can view their Posts. Learn more
We've launching the first big project I worked on at @coda_hq!
👉👈 Connect the two places your team does most of their work with the Coda Bot for @SlackHQ--available to all Coda and Slack users today!
More details: community.coda.io/t/launched…