In 11 gated open-source projects analyzed by Anthropic, Claude identified code reachable prior to user login, including 93 unnecessary pre-authentication surfaces and 37 places running code or saving state before authentication.