Anthropic pointed its Claude models at 25 widely used open-source projects and set them a different task: not finding individual bugs, but finding code that attackers can reach when they should not be able to. Claude flagged 493 such issues. One of them had sat in the software for 21 years.
The work is a preview of research from Anthropic’s Frontier Red Team, written up by security engineer Chris Rohlf and published on Monday. Anthropic calls the approach attack surface reduction.
Instead of fixing flaws one by one, it maps the code a given deployment actually exposes, then moves or gates anything that deployment does not need to expose. That lowers the severity of unknown vulnerabilities, Anthropic said, without having to find a single one.
Claude ran across more than five million lines of C, C++, Java, PHP and Python. It built an inventory of over 17,000 configuration options, Anthropic said. Of those, 3,842 touched a security control. The company sorted the 25 projects into three groups: public services open to anyone, gated ones that require a login, and private tools for an operator’s own environment.
The gated projects produced the sharpest results. All eleven had code reachable before a user logged in, Anthropic said. Claude counted 93 unnecessary pre-authentication surfaces. It found 37 places where code ran, or saved state, before a user logged in. It flagged 61 configuration combinations that silently weakened a login control an administrator had set.
The configuration clashes were the most striking theme. Claude found 162 security-sensitive option combinations that the software accepted with no error or warning. In 94 of them, the pairing silently switched a security control off. One pattern turned up independently in four unrelated projects. A deny rule written with a hostname could fail open, letting through the very clients it was meant to block, when the server had reverse DNS lookups switched off.
The 21-year-old issue was a conflict between two settings. One required every client to prove its identity with a certificate. The other, meant only to delay that check, switched it off entirely. A server set to accept only trusted clients would therefore accept anyone, Anthropic said. The documentation never mentioned that it had dropped the certificate requirement. The clash had sat in the code for 21 years.
Even OpenSSH
The biggest reduction, measured against a project’s size, came in OpenSSH. It is the C program that secures remote server access, and some of the most heavily audited code in the world. Claude traced the SSH daemon in the 10.4 release. It found roughly 4,500 lines of new post-quantum signature code that an unauthenticated client could reach by default, Anthropic said, even when an administrator had excluded the algorithm. That is about 16% of the daemon’s pre-authentication code. Anthropic reported it with patches, and the maintainers shipped fixes across the 10.5 and 10.6 releases.
“OpenSSH is some of the most heavily audited code in the world. If unnecessary reachability survives there, it can survive anywhere,” Anthropic wrote.
The finding drew approval from outside researchers.
Attack surface reduction is the one thing that reliably works.
Halvar Flake (@halvarflake) October 21, 2026
Rohlf framed the technique as a practical use of AI to defend code, not only to break it.
Earlier this year we tasked Claude with autonomously mapping and reducing the attack surface of 25 large and widely used OSS codebases.
chrisrohlf (@chrisrohlf) October 20, 2026
A limit, and the timing
Anthropic was candid about the limits. The techniques do not remove unknown vulnerabilities, it said. They only make them harder to reach, and so cut their severity. The results are Anthropic’s own, from a preview rather than independent testing. The OpenSSH fixes, at least, are public in the project’s release notes, which credit the work with Anthropic and Claude.
Anthropic said it has folded the three techniques into a reusable Claude skill, and is working to add it to its OSS Scanner. The post is the latest in a run of AI-finds-flaws research, after Claude’s earlier work on 271 Firefox bugs, and part of a wider race between AI labs over cyber defence. It also landed a day before an AI-assisted PHP flaw sent much of the web scrambling to patch.