Anthropic says Claude found 493 attack-surface issues in 25 open-source projects, including OpenSSH

One pair of settings had silently turned off a security check for 21 years, and OpenSSH changed its code after Claude's report.

By Think Facility · October 21, 2026 · Anthropic Cybersecurity

On October 20, 2026, Anthropic published research in which Claude went through 25 open-source projects, more than five million lines of code, looking for code that's exposed when it doesn't need to be. It flagged 493 issues. One was a pair of settings that had quietly switched off a security check for 21 years.

The work changed OpenSSH, the secure remote-access software that Anthropic calls some of the most heavily audited code in the world. Its October 6 release, version 10.6, now checks key types before parsing them, and its release notes credit Chris Rohlf of Anthropic, working with Claude.

chrisrohlf@chrisrohlfOct 20, 6:25 pm ET

Reducing the attack surface of deployed services and apps is a fundamental component of software that is secure by design. Earlier this year we tasked Claude with autonomously mapping and reducing the attack surface of 25 large and widely used OSS codebases. This blog post covers some of our methodology and a preview of the data we collected. This research resulted in a significant reduction in OpenSSH pre-authentication attack surface (now fixed in 10.6). And over 500 findings where reachability could be reduced and configurations hardened to ensure security controls weren’t silently disabled. https://t.co/8Iun038PNY

View the post on X

Making bugs harder to reach

Finding and fixing bugs one at a time scales poorly, Anthropic says. So this research tries something else, called attack surface reduction. Rather than hunting for flaws one by one, you shrink the amount of code an attacker can touch at all, so bugs nobody has found yet sit behind a login or a setting.

Claude used three tests. It looked for code reachable in the default setup that no default feature uses, for pairs of options that misbehave together, and for complex code that runs before a check like authentication. Along the way it built an inventory of over 17,000 configuration options, 3,842 of them security relevant.

Projects: 25, in languages including C, C++, Java, PHP and Python
Code: over five million lines
Issues found: 493
Controls silently turned off: 94
Oldest: present in the software for 21 years

What it found

All eleven projects meant to sit behind a login had code that was reachable before it. Anthropic counts 93 unnecessary pre-login surfaces in their default setups, and says none was exploitable on its own (the point is how much larger they make the target).

The settings clashes were worse. Claude found 162 security-sensitive combinations that the software accepted with no error, no warning and no documentation, and in 94 of them a security control was simply off. One pattern turned up in four unrelated projects. An admin writes a deny rule using a hostname, but reverse DNS lookups are off, so the server only ever sees an IP address. The rule can never match. The deny list fails open.

The 21-year case was a server set to demand a certificate from every client. A second option, meant to delay that check, turned it off entirely, so the server accepted anyone. Anthropic doesn't name the project.

OpenSSH

OpenSSH saw the biggest cut, measured as a share of its code. In release 10.4, Claude found about 4,500 lines of new post-quantum signature code, for ML-DSA-44, that a client could reach before logging in, even with the algorithm switched off. That was about 16% of OpenSSH's own pre-login code in a default build. The 10.5 fix had two gaps, which Claude then found. A client could advertise one key type and send another, and certificates got their signatures checked before the config was consulted.

This reduces the attack surface presented by disabled algorithms.

From OpenSSH: Release Notes

After 10.6, Anthropic says, roughly a fifth of the code an unauthenticated client could reach in a default build is out of reach. Halvar Flake gave the approach a one-line verdict the next morning.

Halvar Flake@halvarflakeOct 21, 8:50 am ET

Attack surface reduction is the one thing that reliably works.

View the post on X

If unnecessary reachability survives there, it can survive anywhere.

Using Claude to reduce the attack surface of code \ Anthropic

Why this matters off the server rack

Anthropic's reasoning is that fixing one bug tells you nothing about the ones left, while cutting reachable code lowers the risk from all of them at once, including any already being exploited quietly. A day after the post, on October 21, PHP shipped fixes for two critical flaws where the attack lands before a site's own code runs (our story), which is exactly the kind of early-reachable code this method goes after.

For anyone who runs a server, whether that's a big IT team or one person with a rented box, the practical finding is the settings one. A deny list or certificate rule that looks correct can do nothing, and in Anthropic's examples the software logged no warning. Anthropic doesn't say how many of the 493 issues the projects have fixed so far, apart from OpenSSH's.

Anthropic has packaged the method as a Claude skill and says it's working to add it to OSS-Scanner, its open-source scanning tool. Any change the skill would make to a non-default configuration is set aside for a human to decide.