Anthropic: Claude flags 493 attack-surface issues in 25 open-source projects
Including a 21-year-old silent auth bypass and 16% of OpenSSH’s pre-auth code
Confirmed
The takeaway
Anthropic’s Frontier Red Team published on Oct 20, 2026 a method in which Claude maps which code in a project is reachable by default and removes what a deployment doesn’t need.
Status
- Claim
Confirmed
- Our reporting
- High confidence
- Importance
- 3 of 5
- Last verified
- 22 October 2026
Your AI and this story
- GPT-6 Astra173 days after its cutoff
- Claude Opus 5.5112 days after its cutoff
- Gemini 4 Argon203 days after its cutoff
- Grok 4.7142 days after its cutoff
None of these four assistants can know about it. The closest, Claude Opus 5.5, stops 112 days before it.
Key facts
- Scope: 25 projects (10 public, 11 gated, 4 private), 5M+ lines; Claude catalogued 17,000+ configuration options, 3,842 security-relevant
- Findings: 493 issues across three methods (default configuration, configuration interaction, early reachability); 162 risky option combinations accepted without warning, 94 of which silently disabled a security control
- All 11 gated projects had unintentionally reachable code, including 93 unnecessary pre-authentication surfaces in default configurations
- A hostname-based deny rule failed open when reverse DNS was off, a pattern found independently in four projects
- 21-year-old bug: a certificate-requirement option conflicted with another option and silently dropped the check, letting unauthenticated clients reach request-handling code
- OpenSSH: ~4,500 lines of experimental ML-DSA-44 signature code reachable by unauthenticated clients in default sshd, about 16% of pre-auth code; fixed in 10.5 and 10.6, which ‘removed roughly a fifth’ of the code an unauthenticated client could reach
- Method released as a reusable Claude skill being integrated into OSS-Scanner (three fresh-context passes, findings confirmed with dynamic traces and test suites); author Chris Rohlf
What happened
Instead of hunting individual bugs, Claude was asked to shrink what an attacker can reach at all: code enabled by default that no default feature needs, option combinations that quietly turn off protections, and sensitive parsing that runs before authentication. Maintainers were sent reports and patches.
Why it matters
It shows frontier models doing defensive hardening at scale, reducing the impact of bugs nobody has found yet. It was published the day before PHP2Shell, the AI-found PHP flaw that took sites offline worldwide.
Sources
2 sources from 2 sites. Numbers match the chips in the text.
2 sources: 1 primary, 1 reaction
Primary
- Anthropic: Using Claude to reduce the attack surface of codeanthropic.com, official
Reactions
- Hacker News discussion (132 points)news.ycombinator.com, discussion
Changes
- Filed (Techmeme + HN)