Anthropic’s Frontier Red Team has used Claude to map the code that attackers can actually reach in 25 large open-source projects, flagging 493 issues and, in the sharpest case, helping OpenSSH remove roughly a fifth of the code an unauthenticated client could previously reach in a default build. The research, published by Anthropic researcher Chris Rohlf, treats attack surface reduction — finding code that is exposed but never needed, then gating it — as a defensive use of frontier models that scales better than hunting individual vulnerabilities.
The team ran Claude over projects totalling more than five million lines of code, written in languages including C, C++, Java, PHP and Python. Claude built an inventory of more than 17,000 configuration options across the 25 projects and classified 3,842 of them as security-relevant, before testing how those options behaved in combination and in the moments before authentication.
Claude’s Three Passes Over 25 Codebases
Anthropic’s method looks for three kinds of unnecessary exposure. The first is code reachable in a shipped default configuration that no default functionality uses. The second is configuration interaction: pairs of options that look reasonable alone but cause trouble together, for instance by silently disabling a security control. The third is early reachability — complex, security-sensitive code that runs before authentication, before user interaction, or before a protocol state transition it should sit behind.
The results were most surprising in the eleven projects Anthropic classifies as gated — software meant to serve only authenticated users. Claude found 93 unnecessary pre-authentication surfaces in their default configurations, 37 places where code executed or state was recorded before authentication, and 61 configuration combinations that silently weakened a pre-authentication control an administrator had set. None of those issues was immediately exploitable on its own, Anthropic says, but each one enlarged the surface an attacker could work on.
Configuration Pairs That Silently Switched Controls Off
The configuration-interaction pass produced what Anthropic calls some of the most impactful findings. Claude identified 162 security-sensitive option pairs that software accepted with no error, no warning and no documented behaviour. In 94 of those cases, the combination silently turned a security control off. The other 68 were inconsistencies in the same mechanisms — a listener staying reachable after the configuration said it was disabled, or a protection doing nothing while its code remained exposed.
One pattern turned up independently in four unrelated projects. An administrator writes an access rule using a hostname or wildcard pattern; whether the server ever learns a connecting client’s hostname depends on a separate reverse-DNS option that most projects ship turned off. With lookups off, the server compares the hostname rule against the client’s IP address as plain text — which can never match — so a deny rule never fires and the list fails open. Anthropic also describes a conflicting option pair, present in one project for 21 years, that silently dropped a required client-certificate check and exposed a large body of request-handling code to unauthenticated clients.
The OpenSSH Case: 4,500 Lines Of ML-DSA-44
Measured as a share of total code, OpenSSH saw the largest reduction. Tracing the SSH daemon’s input paths in the 10.4 release, Claude found roughly 4,500 lines of new, experimental code for ML-DSA-44, a post-quantum signature algorithm, that an unauthenticated client could reach in the default configuration — about 16% of OpenSSH’s own pre-authentication code in a default sshd. The algorithm is not enabled by default, yet the daemon parsed whichever key type a client sent, and verified embedded CA signatures for certificates, before checking whether that key type was allowed.
Anthropic reported the issue with patches. OpenSSH 10.5 moved the check before parsing, but Claude then found two gaps: the check read the algorithm name a client advertised while the parser followed a type string inside the key blob, so a client could advertise ssh-ed25519 and still send an ML-DSA key; and certificate handling ran full signature verification on embedded CA keys for any supported algorithm before consulting the configuration. Working through several fix iterations with the maintainers, the check now sits inside the parser itself, comparing the encoded key type and certificate signature algorithm against the configured allow lists before any deserialisation or verification. The changes shipped in OpenSSH 10.6, whose release notes credit Rohlf “in collaboration with Claude and Anthropic Research”. Anthropic has packaged the three-pass method as a reusable Claude skill it is working to integrate into its OSS-Scanner. The work sits alongside Anthropic’s wider security research with Claude, including its Claude Mythos 5 quantum-circuit results and the defensive questions raised by incidents such as the OpenCode console breach. A primer on the assistant itself is in What Is Claude?
Why It Matters
OpenSSH guards remote access to a large share of the world’s servers, and it is among the most heavily audited C codebases in existence — Rohlf’s closing line is that if unnecessary reachability survives there, it can survive anywhere. The significance of the OpenSSH fix is that it did not require finding a single exploitable bug: moving one check earlier made roughly a fifth of the pre-authentication code unreachable, which reduces the severity of every unknown vulnerability in that code at once, including any already being quietly exploited. For maintainers of other long-lived infrastructure projects, the 493-issue haul across 25 codebases suggests the same class of exposure is common, and that a model-driven audit of defaults, option pairs and pre-authentication paths is now a practical first pass before traditional review.
Background
Anthropic’s Frontier Red Team has spent the past year publishing data on what frontier models can do in cybersecurity, from discovering vulnerabilities to exploiting them. This study flips that work toward defence: instead of asking Claude to find a flaw, the team asked it to map reachability across mature open-source projects and remove what deployments never needed to expose. OpenSSH, maintained by the OpenBSD project, has shipped secure remote access since 1999 and is a default component of most Unix-like systems, which is why its pre-authentication parsing code is such a sensitive target.
Source: Anthropic
0 Comments