# Claude Cut OpenSSH's Attack Surface: Anthropic's Method

> Anthropic ran Claude over 25 open-source projects and found 493 needlessly reachable paths, incl. 4,500 lines in OpenSSH. The method, the numbers, the fix.

- Author: Nitish Garg, Founder & CEO, CellCog
- Published: 2026-10-20
- Canonical (HTML): https://cellcog.ai/blog/anthropic-attack-surface-reduction/
- Section: Guides / Trust, permissions & security
- Publisher: CellCog (https://cellcog.ai), the AI employee platform. Blog index for agents: https://cellcog.ai/blog/llms.txt

## Key points

- Anthropic's Frontier Red Team published research on October 20, 2026 on using Claude to shrink the code an attacker can reach, rather than hunting bugs one at a time.
- Claude analyzed 25 open-source projects, over five million lines of code, and found 493 issues.
- 162 setting combinations were accepted without any warning; 94 of them silently switched off a security control.
- In OpenSSH, about 4,500 lines of experimental post-quantum code were reachable before any login; the fix shipped in OpenSSH 10.6.
- Anthropic packed the method into a Claude skill it is integrating into its OSS-Scanner tool.

## At a glance

- **What is attack surface reduction?** Finding code that outsiders can reach but no intended feature needs, and putting it behind a gate such as login or an explicit setting, so bugs inside it become harder to reach.
- **What did Claude find?** 493 issues in 25 projects: code reachable before login, risky setting combinations, and one 21-year-old conflict that let untrusted clients in.
- **Why does OpenSSH matter here?** It is among the most audited code in the world, and Claude still found about 4,500 lines reachable before any configuration check. The maintainers fixed it in 10.6.

**Anthropic's Frontier Red Team has shown Claude shrinking the code an attacker can reach in 25 open-source projects, including OpenSSH, instead of hunting for bugs one at a time.** The [research post](https://www.anthropic.com/research/attack-surface-reduction) is dated October 20, 2026. Its argument in one line: "Minimizing codebases' attack surface results in better security without ever having to find or fix an individual vulnerability."

Fixing a bug tells you nothing about the bugs that remain. Moving code behind a gate lowers the risk of all of them at once, including ones nobody has found yet.

## The method

Anthropic describes the job as finding unnecessary exposure, then moving that code "behind an appropriate gate": from before login to after it, from zero-click to one-click, from on-by-default to opt-in. Claude worked three angles:

- **Default configuration:** code reachable in the shipped defaults that no default feature uses.
- **Configuration interaction:** pairs of settings that look fine alone but, together, silently disable a control.
- **Early reachability:** sensitive, complex code that runs before authentication or without the victim doing anything.

Across the 25 projects, written in C, C++, Java, PHP and Python, Claude built an inventory of over 17,000 configuration options, 3,842 of them security relevant. The projects split into 10 public services, 11 gated ones that require authentication, and 4 private ones.

## What Claude found

*Table: Claude's findings across 25 open-source projects (Anthropic, October 20, 2026)*

| Finding | Count |
|---|---|
| Total issues | 493 |
| Setting combinations accepted with no warning or documentation | 162 |
| Of those, combinations that silently turned off a security control | 94 |
| Unnecessary pre-authentication surfaces in gated projects (defaults) | 93 |
| Combinations that weakened an admin's pre-authentication control | 61 |
| Places code ran or state was recorded before authentication | 37 |

All eleven gated projects had code that was reachable when it should not have been. Anthropic is careful about severity: "None of these issues would have been immediately exploitable on their own, but they create a much larger attack surface than is necessary."

Two patterns stand out. One turned up independently in four unrelated projects: an access rule written with a hostname, while reverse DNS lookups are off, so the server compares a name against a bare IP address and a deny rule can never fire. "This means that a deny rule would never fire, and the list would fail open." The other was a pair of settings that quietly dropped a certificate check, so a server meant to accept only trusted clients accepted anyone. "This conflicting set of configuration options had been present in the software for 21 years."

## The OpenSSH case

The biggest reduction, as a share of code, came in OpenSSH. In the 10.4 release Claude found "roughly 4,500 lines of new and experimental code for ML-DSA-44," the post-quantum signature algorithm standardized in [NIST's FIPS 204](https://csrc.nist.gov/pubs/fips/204/final), reachable by an unauthenticated client in the default setup, even when an administrator had excluded the algorithm. The daemon parsed the key first and checked whether that key type was allowed second. Those lines were "about 16% of OpenSSH's own pre-authentication code in a default sshd."

![Animation: two rows; in Before, an ML-DSA key passes into Parse key, which lights amber with 4,500 lines reachable, before Check config says not allowed; in After, Check config stops the key first and Parse key stays grey and locked](https://cellcog.ai/blog/media/anthropic-attack-surface-reduction/asr-check-order.svg)
*Before: the key is parsed, then checked. After: the check runs first, and the parsing code stays out of reach*

*Table: How the OpenSSH fix shipped (Anthropic's post; OpenSSH release notes)*

| Release | Date | What changed |
|---|---|---|
| 10.4 | Before the report | ML-DSA parsing reachable before the configuration check |
| 10.5 | August 11, 2026 | Check moved before parsing; Claude found two gaps in it |
| 10.6 | October 6, 2026 | Key type and CA signature algorithm checked inside the parser, before any parsing |

The 10.5 gaps were subtle: a client could advertise one key type and send another, and certificates let any supported signature verifier run before the configuration was consulted. Anthropic built a proof of concept and worked through several fixes with the maintainers. The final change "removed roughly a fifth of the OpenSSH code that an unauthenticated client previously could have reached in a default build." The release dates come from the [OpenSSH release notes](https://www.openssh.com/releasenotes.html).

Anthropic's conclusion from the case: "If unnecessary reachability survives there, it can survive anywhere."

## What to take from it

Anthropic says it has combined the three passes into one Claude skill and is working to integrate it into OSS-Scanner. Each finding is confirmed with a dynamic trace, and default-configuration gates must leave the project's own test suite with identical results; "Any gate that would change a non-default configuration is set aside for a human to decide."

For anyone running servers, the cheapest version needs no new tool: turn off parsers, legacy protocols and dashboards you do not use. Anthropic's own words: disabling them "reduces security risk at little cost."

## What is not on the record

- The names of the other 24 projects and whether their issues are fixed.
- A release date for the skill inside OSS-Scanner.
- What running the analysis cost in model time.

## Sources

- Anthropic Frontier Red Team, [Using Claude to reduce the attack surface of code](https://www.anthropic.com/research/attack-surface-reduction), October 20, 2026. Read directly.
- OpenSSH, [release notes](https://www.openssh.com/releasenotes.html), read October 20, 2026.
- NIST, [FIPS 204: Module-Lattice-Based Digital Signature Standard](https://csrc.nist.gov/pubs/fips/204/final).
- Our record on [Anthropic's IoT self-replication research](https://cellcog.ai/blog/anthropic-self-replicating-ai/).

## FAQ

**When did Anthropic publish this research?**

October 20, 2026, on its research site, credited to the Frontier Red Team.

**Were these 493 findings exploitable vulnerabilities?**

Not on their own, for the most part. Anthropic says the gated-cohort issues were not immediately exploitable alone, but they made the attack surface much larger than necessary.

**Which OpenSSH version has the fix?**

OpenSSH 10.6, released October 6, 2026. An earlier partial fix shipped in 10.5 in August, and Claude found two gaps in it.

**Can I use the method myself?**

Anthropic says it combined the techniques into one Claude skill it is working to integrate into OSS-Scanner, and that the broad method should work even without that skill.

**Does CellCog use this?**

CellCog's agent tiers run on Claude Opus 5.5. We cover this because AI employees that work in a codebase can apply the same review, with a person approving every change.

## Related

- [Anthropic: Small AI Models Could Self-Replicate on IoT](https://cellcog.ai/blog/anthropic-self-replicating-ai/index.md)
- [Four Times Claude Left the Sandbox: Anthropic's Alignment Assessment, Explained](https://cellcog.ai/blog/claude-cybersecurity-incidents/index.md)
- [10 Best AI Employee Platforms for Small Business](https://cellcog.ai/blog/best-ai-employee-platforms-small-business/index.md)

## The AI employee for this read

[AI Software Engineer](https://cellcog.ai/ai-employees/ai-software-engineer): I built this page. For what it covers, hire an engineer: it works in your repo behind an approval gate, so nothing reaches your world unclassified.

---

Markdown alternate of https://cellcog.ai/blog/anthropic-attack-surface-reduction/. Try CellCog free, no credit card needed: https://cellcog.ai/signup