Anthropic: Claude found 493 attack surface issues in 25 projects

01What happened

Chris Rohlf of Anthropic's Frontier Red Team published the work on October 20, 2026. Claude examined 25 open-source projects totalling more than five million lines of C, C++, Java, PHP and Python, and produced 493 issues. OpenSSH is the case study: Anthropic reported findings with patches, and the OpenSSH release notes credit Rohlf in 10.5 and credit him with Claude and Anthropic Research in 10.6.

02How it works

Claude looked at three things instead of hunting individual bugs: code reachable in the shipped default configuration that no default feature needs, option pairs that are each reasonable but unsafe together, and complex security-sensitive code that runs before authentication or before a protocol state change. Anthropic inventoried more than 17,000 configuration options and marked 3,842 of them security-relevant. The method now runs as a Claude skill in three passes, each starting with a fresh context, with findings confirmed against dynamic traces and the project's own test suites.

03Who is affected

OpenSSH is the only project Anthropic names. In version 10.4 about 4,500 lines of ML-DSA-44 code were reachable before authentication in a default build, roughly 16% of the default sshd's pre-authentication code, and Anthropic says the 10.6 fix removed about a fifth of what an unauthenticated client could previously reach. Across the projects Anthropic groups as gated it counts 93 unnecessary pre-authentication surfaces and 61 option combinations that silently weakened a pre-authentication control.

04What to do

Anthropic's suggestion for defenders is to compare runtime logs against deployed configuration and switch off parsers, legacy protocols and dashboards that nothing uses. Anthropic says the skill is being integrated into OSS-Scanner, and that most gated-project findings were not exploitable on their own, so treat this kind of output as surface reduction rather than a vulnerability list.

Questions people ask

Does reducing attack surface fix the vulnerabilities Claude found?

Anthropic is explicit that reducing reachability does not remove unknown vulnerabilities and only makes them harder to reach, and states that it is perhaps impossible to measure how many unknown vulnerabilities any given codebase holds. Most findings in the projects Anthropic groups as gated were not immediately exploitable on their own. The claim on offer is severity reduction, not bug elimination.

What did Anthropic report to OpenSSH?

Anthropic reported the pre-authentication reachability of ML-DSA-44 code with patches, and says its proof of concept defeated the check OpenSSH added in 10.5, because a client could advertise one key type and send another while certificate CA signature paths went ungated. Anthropic says the final fix in 10.6 moved the checks inside the parser, before deserialization or signature verification.

Did OpenSSH confirm Anthropic's contribution?

The OpenSSH release notes name Christopher Paul Rohlf of Anthropic for the 10.5 change that moves the public key type check before the peer's key is parsed, and for a ssh-keygen double-free fix. In 10.6, released October 6, 2026, two entries credit Chris Rohlf in collaboration with Claude and Anthropic Research, including the stricter key and CA signature type checks.

Can other teams use Anthropic's attack surface method?

Anthropic packaged the three passes into a reusable Claude skill and says it is being integrated into OSS-Scanner, while noting the broader methodology is likely effective without that specific skill. Anthropic encourages organisations to analyse the software they depend on the same way, and leaves decisions about non-default configuration changes to a human reviewer.

Sources 2 links, all fetched

1. 1anthropic.comAnthropic Research
2. 2openssh.orgOpenSSH Release Notes