The Claude logo. Image: Anthropic
Anthropic pointed Claude at the code strangers can reach before they ever log in, and found that OpenSSH, the program behind secure remote logins on countless servers, was exposing about 4,500 lines of experimental code it didn’t need to. In research published on October 20, Anthropic’s Frontier Red Team says Claude found 493 issues across 25 open-source projects, and OpenSSH has already shipped the fixes.
Rather than hunting individual bugs, Claude mapped which code an attacker could actually reach, then helped put whatever a deployment doesn’t need behind a gate.
Shrinking the target instead of chasing bugs #
The post, by Anthropic researcher Chris Rohlf, argues that fixing vulnerabilities one at a time “scales poorly”, because fixing even a critical one tells you nothing about the ones that remain. Cutting how much code is reachable lowers the risk from every unknown flaw at once, including any already being exploited.
Claude looked for three things: code reachable in a project’s default setup that no default feature uses; pairs of settings that look fine alone but cause trouble together, for instance by quietly switching off a security control; and complex, security-sensitive code that runs before a check such as authentication, or without the victim doing anything.
The 25 projects, which Anthropic doesn’t name apart from OpenSSH, add up to more than five million lines of C, C++, Java, PHP, Python and other code.
493 issues, and one that lasted 21 years #
Eleven of the projects are meant to serve only signed-in users, and Claude found code reachable before login in all eleven: 93 unnecessary pre-authentication surfaces in their default setups, 37 places where code ran or state was recorded before authentication, and 61 setting combinations that silently weakened a login control an administrator had set up. Anthropic says none would have been immediately exploitable on its own.
Across all the projects, Claude found 162 security-sensitive setting combinations that the software accepted without an error, a warning or any documentation. In 94 of them, the combination silently turned a security control off. One pattern turned up in four unrelated projects: a deny rule written as a hostname never fires when reverse DNS lookups are off, as they were in most of the projects, because the server only ever sees the client’s IP address. The list fails open.
In another project, two options clashed so that a server set up to accept only clients with trusted certificates would accept a connection from anyone. Anthropic says that conflict had been in the software for 21 years. It doesn’t name the project, so the claim can’t be checked independently.
How OpenSSH closed the gap #
Measured as a share of its code, the biggest reduction came in OpenSSH. Claude traced the SSH server’s input paths in release 10.4 and found roughly 4,500 lines of new, experimental code for ML-DSA-44, a post-quantum signature algorithm, that an unauthenticated client could reach in the default configuration, even when an administrator had explicitly excluded the algorithm. Anthropic puts that at about 16% of OpenSSH’s own pre-login code in a default server.
Anthropic reported it with patches, and version 10.5 moved the check earlier. Claude then found two ways round that check, including hiding an ML-DSA key inside an otherwise acceptable certificate. After several rounds with the maintainers, the check now sits inside the key parser itself. OpenSSH’s release notes for version 10.6, out on October 6, say the change “reduces the attack surface presented by disabled algorithms” and credit Rohlf “in collaboration with Claude and Anthropic Research”. Anthropic says the fix removed roughly a fifth of the code an unauthenticated client could reach in a default build.
Rohlf draws a wider lesson from it:
OpenSSH is some of the most heavily audited code in the world. If unnecessary reachability survives there, it can survive anywhere.
Chris Rohlf, Anthropic Frontier Red Team
A Claude skill for open-source maintainers #
Anthropic has rolled the three methods into a reusable Claude skill that it is working to add to OSS Scanner, its free bug-scanning service for open-source projects. It confirms every finding with a live trace of the program, checks that any gate leaves the project’s own tests passing unchanged, and leaves changes to non-default setups for a human to decide.
Anthropic says Claude can do this “economically”, but publishes no cost figures or model name. The research follows its red team warned that a Chinese model anyone can download can now build working hacks on its own, and as security firms such as Palo Alto Networks point frontier models at customers’ systems around the clock.
Why it matters #
AI models that find bugs help attackers as much as defenders, and attackers need only one flaw. Shrinking what can be reached before login protects against flaws nobody has found yet, and the OpenSSH changes show the approach can land in heavily used, heavily audited software.
Sources: Anthropic Frontier Red Team, OpenSSH 10.6 release notes.