Anthropic's Frontier Red Team used Claude to map and shrink reachable code in 25 open-source projects, a review covering more than five million lines of C, C++, Java, PHP and Python that produced 493 reported issues. The research, published October 20 by Anthropic's Chris Rohlf, targets code a deployment exposes but does not need, rather than hunting individual bugs.
The premise is that cutting the code an attacker can reach lowers the severity of vulnerabilities nobody has found yet, without having to find or fix each one. Claude inventoried more than 17,000 configuration options across the projects, 3,842 of which were security-relevant.
Anthropic sorted the projects into three groups: 10 public projects that serve any reachable user or consume data from unidentified parties, 11 gated projects that serve only authenticated users, and 4 private projects that run inside an operator's own environment. Claude applied three methods to each: finding code reachable in default configurations that no default feature needs, testing option pairs that are reasonable alone but problematic together, and tracing sensitive code that runs before authentication or before a protocol state change.
Key facts
- 01Claude reviewed 25 open-source projects totaling more than five million lines of code and reported 493 issues.
- 02It inventoried over 17,000 configuration options, 3,842 of them security-relevant.
- 03162 option combinations were accepted without warning; 94 silently disabled a security control.
- 04OpenSSH 10.4 exposed about 4,500 lines of ML-DSA-44 code to unauthenticated clients by default, about 16% of pre-auth code.
- 05The fix shipped in OpenSSH 10.6, removing about a fifth of the code unauthenticated clients could reach.
All 11 gated projects had unintentionally reachable code. Anthropic counted 93 unnecessary pre-authentication surfaces in default configurations, 37 places where code ran or state was recorded before authentication, and 61 option combinations that silently weakened a pre-authentication control.
Across the full set, Claude found 162 security-sensitive option combinations that were accepted without warning or documentation, and in 94 of them the combination silently disabled a security control. In four unrelated projects, hostname-based deny rules never matched when reverse DNS lookups were off, so the deny list failed open. One conflict between two options silently dropped a client certificate check and had existed for 21 years.
The most detailed case study is OpenSSH. In release 10.4, Claude found roughly 4,500 lines of experimental ML-DSA-44 post-quantum signature code that unauthenticated clients could reach in the default configuration, about 16% of the pre-authentication code in a default sshd.
Anthropic reported the issue with patches, and OpenSSH 10.5 moved the relevant check ahead of parsing. Claude then found two remaining gaps: the check trusted the algorithm a client advertised instead of the key type actually parsed, and certificate authority signatures were verified before any configuration check ran.
The final fix shipped in OpenSSH 10.6 and places the allow-list checks inside the parser, ahead of deserialization and signature verification. Anthropic says the change removed about a fifth of the code an unauthenticated client could previously reach.
Anthropic has packaged the techniques into a Claude skill that runs three passes, covering default configuration, pre-gate code and configuration combinations, each with a fresh context window. Changes to default behavior are validated against the project's own test suite and a black-box regression suite, while changes affecting non-default configurations are left to a human to decide.
Anthropic says the team is now working to integrate the skill into OSS-Scanner.
Working on something we should cover, or seeing a story we missed? Send leads, documents, or feedback to hello@aichatdaily.com. For sensitive tips, see our secure tips page for Signal and PGP options.
Spotted an error? Email hello@aichatdaily.com with the URL and the issue, or read our full corrections policy.
