Anthropic’s Frontier Red Team has shown Claude shrinking the code an attacker can reach in 25 open-source projects, including OpenSSH, instead of hunting for bugs one at a time. The research post is dated October 20, 2026. Its argument in one line: “Minimizing codebases’ attack surface results in better security without ever having to find or fix an individual vulnerability.”
Fixing a bug tells you nothing about the bugs that remain. Moving code behind a gate lowers the risk of all of them at once, including ones nobody has found yet.
On this page · 6 sectionsOpen
Anthropic’s Frontier Red Team published research on October 20, 2026 on using Claude to shrink the code an attacker can reach, rather than hunting bugs one at a time.
Claude analyzed 25 open-source projects, over five million lines of code, and found 493 issues.
162 setting combinations were accepted without any warning; 94 of them silently switched off a security control.
In OpenSSH, about 4,500 lines of experimental post-quantum code were reachable before any login; the fix shipped in OpenSSH 10.6.
Anthropic packed the method into a Claude skill it is integrating into its OSS-Scanner tool.
§ 01The method
Anthropic describes the job as finding unnecessary exposure, then moving that code “behind an appropriate gate”: from before login to after it, from zero-click to one-click, from on-by-default to opt-in. Claude worked three angles:
- Default configuration: code reachable in the shipped defaults that no default feature uses.
- Configuration interaction: pairs of settings that look fine alone but, together, silently disable a control.
- Early reachability: sensitive, complex code that runs before authentication or without the victim doing anything.
Across the 25 projects, written in C, C++, Java, PHP and Python, Claude built an inventory of over 17,000 configuration options, 3,842 of them security relevant. The projects split into 10 public services, 11 gated ones that require authentication, and 4 private ones.
§ 02What Claude found
| Finding | Count |
|---|---|
| Total issues | 493 |
| Setting combinations accepted with no warning or documentation | 162 |
| Of those, combinations that silently turned off a security control | 94 |
| Unnecessary pre-authentication surfaces in gated projects (defaults) | 93 |
| Combinations that weakened an admin’s pre-authentication control | 61 |
| Places code ran or state was recorded before authentication | 37 |
All eleven gated projects had code that was reachable when it should not have been. Anthropic is careful about severity: “None of these issues would have been immediately exploitable on their own, but they create a much larger attack surface than is necessary.”
Two patterns stand out. One turned up independently in four unrelated projects: an access rule written with a hostname, while reverse DNS lookups are off, so the server compares a name against a bare IP address and a deny rule can never fire. “This means that a deny rule would never fire, and the list would fail open.” The other was a pair of settings that quietly dropped a certificate check, so a server meant to accept only trusted clients accepted anyone. “This conflicting set of configuration options had been present in the software for 21 years.”
§ 03The OpenSSH case
The biggest reduction, as a share of code, came in OpenSSH. In the 10.4 release Claude found “roughly 4,500 lines of new and experimental code for ML-DSA-44,” the post-quantum signature algorithm standardized in NIST’s FIPS 204, reachable by an unauthenticated client in the default setup, even when an administrator had excluded the algorithm. The daemon parsed the key first and checked whether that key type was allowed second. Those lines were “about 16% of OpenSSH’s own pre-authentication code in a default sshd.”
| Release | Date | What changed |
|---|---|---|
| 10.4 | Before the report | ML-DSA parsing reachable before the configuration check |
| 10.5 | August 11, 2026 | Check moved before parsing; Claude found two gaps in it |
| 10.6 | October 6, 2026 | Key type and CA signature algorithm checked inside the parser, before any parsing |
The 10.5 gaps were subtle: a client could advertise one key type and send another, and certificates let any supported signature verifier run before the configuration was consulted. Anthropic built a proof of concept and worked through several fixes with the maintainers. The final change “removed roughly a fifth of the OpenSSH code that an unauthenticated client previously could have reached in a default build.” The release dates come from the OpenSSH release notes.
Anthropic’s conclusion from the case: “If unnecessary reachability survives there, it can survive anywhere.”
§ 04What to take from it
Anthropic says it has combined the three passes into one Claude skill and is working to integrate it into OSS-Scanner. Each finding is confirmed with a dynamic trace, and default-configuration gates must leave the project’s own test suite with identical results; “Any gate that would change a non-default configuration is set aside for a human to decide.”
For anyone running servers, the cheapest version needs no new tool: turn off parsers, legacy protocols and dashboards you do not use. Anthropic’s own words: disabling them “reduces security risk at little cost.”
§ 05What is not on the record
- The names of the other 24 projects and whether their issues are fixed.
- A release date for the skill inside OSS-Scanner.
- What running the analysis cost in model time.
§ 06Sources
- Anthropic Frontier Red Team, Using Claude to reduce the attack surface of code, October 20, 2026. Read directly.
- OpenSSH, release notes, read October 20, 2026.
- NIST, FIPS 204: Module-Lattice-Based Digital Signature Standard.
- Our record on Anthropic’s IoT self-replication research.
Q1When did Anthropic publish this research?
October 20, 2026, on its research site, credited to the Frontier Red Team.
Q2Were these 493 findings exploitable vulnerabilities?
Not on their own, for the most part. Anthropic says the gated-cohort issues were not immediately exploitable alone, but they made the attack surface much larger than necessary.
Q3Which OpenSSH version has the fix?
OpenSSH 10.6, released October 6, 2026. An earlier partial fix shipped in 10.5 in August, and Claude found two gaps in it.
Q4Can I use the method myself?
Anthropic says it combined the techniques into one Claude skill it is working to integrate into OSS-Scanner, and that the broad method should work even without that skill.
Q5Does CellCog use this?
CellCog’s agent tiers run on Claude Opus 5.5. We cover this because AI employees that work in a codebase can apply the same review, with a person approving every change.