The AI labs keep promising their models can do anything. This week, Anthropic gave Claude a job that actually matters — and the results are genuinely impressive. Anthropic pointed Claude at 25 open-source projects and told it to play security auditor: map every line of code an attacker could reach, and flag what shouldn't be exposed. Claude came back with 493 issues.
The research: 5 million lines of code under the microscope
The study, published October 20, 2026 by Anthropic's Frontier Red Team under Chris Rohlf, is about "attack surface reduction" — mapping the code that is reachable, then cutting or restricting everything a deployment doesn't need to expose. Claude analyzed 25 open-source projects spanning more than five million lines of C, C++, Java, PHP, and Python code.
The numbers are striking. Claude inventoried more than 17,000 configuration options, 3,842 of them tied to security-relevant controls. It found 162 risky setting combinations — and in 94 of those cases, combining the options silently turned off a security control, with no warning and no error. Every one of the 11 login-gated projects had code reachable before authentication: 93 unnecessary pre-authentication attack surfaces in default configurations, 37 cases where code ran or recorded state before login, and 61 configuration combinations that weakened a pre-login control.
The most unnerving detail: one conflicting pair of options — where one setting demanded clients prove their identity with certificates while another quietly disabled the check entirely — had sat in the software for 21 years. Nobody noticed. Claude did.
The OpenSSH case study: 4,500 lines of code nobody should reach
The sharpest example is OpenSSH, some of the most heavily audited code in the world. Claude traced the SSH daemon's input paths in release 10.4 and found roughly 4,500 lines of new, experimental code for ML-DSA-44 — a post-quantum signature algorithm — that an unauthenticated client could reach in the default configuration. That's about 16% of OpenSSH's own pre-authentication code, reachable even when an administrator had explicitly excluded the algorithm. The daemon parsed whatever key the client sent and only then checked whether it was allowed.
Anthropic reported the findings to the OpenSSH maintainers along with patches. OpenSSH 10.5 moved the check before parsing — but Claude then found two ways around that fix, including a client lying about its key type. After several rounds with the maintainers, the final change in OpenSSH 10.6 moved the checks inside the parser itself. Net result: roughly a fifth of the code an unauthenticated client could reach in a default build is now unreachable. OpenSSH's own release notes credit Rohlf "in collaboration with Claude and Anthropic Research."
Why it matters
Anthropic is refreshingly honest about the limits here. These are attack surfaces, not confirmed exploitable bugs — there are no CVE assignments and no per-project severity breakdown. As Rohlf writes, these techniques "don't remove the unknown vulnerabilities in the code, but they do make the vulnerabilities harder to reach." Still, the lesson lands hard: if unnecessary reachability survives in OpenSSH, the most audited code on earth, it can survive anywhere. Anthropic has now packaged the method into a reusable Claude skill and says it will integrate it into its OSS-Scanner service.
The timing isn't accidental either. This is the same week reports surfaced of an autonomous AI pentesting tool being used against about 20 Japanese companies, and researchers breached OpenAI's own systems using Claude in an authorized security exercise. AI is entering the security game on both sides at once — as the attacker and as the auditor.
The take
Here's what I love about this story: it's AI doing the unglamorous, high-leverage work — auditing the internet's plumbing instead of generating more marketing copy. Nobody noticed 4,500 lines of experimental crypto code sitting in front of OpenSSH's login screen, or a 21-year-old config conflict that silently disabled certificate checks. Claude found both. The most important AI security story of the year isn't models fighting models — it's AI quietly making the code everything runs on harder to break into.
Comments
Post a Comment