Claude Attack Surface Reduction: How OpenSSH Got Smaller

Most security work hunts for individual bugs. Anthropic's Frontier Red Team has published research on a complementary idea that may scale better: use Claude to find code that attackers can reach but that a deployment never needs to expose, then put it behind a proper gate. In a post dated October 20, 2026, the team reports running Claude across 25 open-source projects and turning up 493 attack surface issues — including a change that shipped in OpenSSH 10.6 and cut its pre-authentication reachable code by roughly a fifth.

• Scope: 25 open-source projects totaling more than five million lines of C, C++, Java, PHP and Python, with Claude inventorying over 17,000 configuration options
• Findings: 493 issues, including 162 risky configuration combinations accepted without warning — 94 of which silently disabled a security control
• OpenSSH: about 4,500 lines of experimental ML-DSA-44 post-quantum code, around 16% of default sshd pre-auth code, were reachable before configuration checks; fixes landed in OpenSSH 10.5 and 10.6
• What's next: Anthropic is packaging the method as a Claude skill for OSS Scanner, its free, opt-in scanning service for open-source projects

What Is Attack Surface Reduction?

Attack surface is everything an attacker can touch. Reducing it means moving code from before authentication to after it, from on-by-default to opt-in, or from the first message of a protocol to deeper in the session. As Anthropic's Chris Rohlf puts it, these techniques do not remove unknown vulnerabilities, but they make them harder to reach — which lowers their severity across the board, including for bugs nobody has found yet. Fixing one critical bug tells you nothing about the next one; closing an unnecessary door protects against everything behind it.

Claude looked for three patterns:

• Default configuration: code reachable in the shipped defaults but not used by any default feature
• Configuration interaction: pairs of settings that look fine alone but silently weaken a control together
• Early reachability: complex or security-sensitive code running before authentication, user interaction or a protocol state change

What Did Claude Find in Open-Source Projects?

Every one of the 11 "gated" projects — software meant to serve only authenticated users — had some unintentionally reachable code. Claude logged 93 unnecessary pre-authentication surfaces in default configurations, 37 places where code ran or state was recorded before authentication, and 61 configuration combinations that weakened an administrator's pre-auth control. Anthropic stresses none of these were immediately exploitable on their own.

The configuration findings were the most striking. In four unrelated projects, hostname-based deny rules silently failed open when reverse DNS lookups were off, because a hostname pattern can never match a bare IP address. In another case, two settings that had coexisted for 21 years let a server configured to require client certificates accept connections from anyone. Help Net Security's write-up highlights the same examples.

How Did OpenSSH 10.6 Get Smaller?

OpenSSH is some of the most heavily audited C code in the world, which makes this case study encouraging rather than alarming. Claude traced sshd 10.4 and found the daemon parsed whatever key type a client sent, including the new ML-DSA-44 code, before checking whether that algorithm was allowed — even when administrators had excluded it.

Anthropic reported the issue with patches. OpenSSH 10.5 moved the check ahead of parsing; Claude then spotted two remaining gaps, involving a mismatched advertised key type and certificate CA signatures verified before configuration checks. After several iterations with the maintainers, OpenSSH 10.6 placed the allow-list checks inside the parser itself. The result removed roughly a fifth of the code an unauthenticated client could previously reach in a default build. It is a model of responsible disclosure done collaboratively, and a nice sequel to the post-quantum work in OpenSSH 10.4.

How Can Developers Use This Approach?

The upcoming Claude skill runs three fresh passes over a codebase — default reachability, pre-gate code, and dangerous setting combinations — and confirms each finding with a dynamic trace. For default-configuration fixes, it implements a gate and requires the project's own test suite plus a black-box regression suite to produce identical results; anything that would change non-default behavior is left for a human to decide. Even without the skill, the methodology is simple to borrow: inventory entry points, question every pre-auth path, and reject contradictory configs at load time.

Follow more defensive research in our AI security coverage.

Sources: Anthropic — Using Claude to reduce the attack surface of code — October 20, 2026; Help Net Security — October 22, 2026.