Claude Finds 493 Attack-Surface Issues in 25 Open-Source Projects, Including a 21-Year-Old Config Conflict

Anthropic's Frontier Red Team has published research describing how it pointed Claude at 25 open-source projects — more than 5 million lines of C, C++, Java, PHP and Python — and produced 493 reported attack-surface issues. The work, authored by Chris Rohlf and released this week, is notable less for bug counts than for its premise: instead of hunting individual vulnerabilities, the team used the model to shrink the amount of code an unauthenticated attacker can reach at all.

The argument is that fixing bugs one at a time scales poorly, since patching even a critical flaw tells you nothing about the ones still lurking. Cutting reachable code lowers the severity of every unknown vulnerability simultaneously. To that end, Claude inventoried more than 17,000 configuration options across the projects, of which 3,842 touched a security-relevant control.

The findings concentrated in configuration interactions. Across the set, Claude identified 162 security-sensitive option pairs that software accepted with no error, warning or documentation — and in 94 of them the combination silently switched off a security control. Eleven projects meant to serve only authenticated users all had unintentionally reachable code, including 93 unnecessary pre-authentication surfaces in default configurations. One option conflict quietly dropped a client-certificate requirement and had been present, according to Anthropic, for 21 years. A separate pattern appeared in four unrelated projects: hostname-based deny rules that never match — and fail open — when reverse DNS lookups are off. Anthropic says none of the findings would have been immediately exploitable on their own.

The deepest case study is OpenSSH. In release 10.4, Claude traced the daemon's input paths and found roughly 4,500 lines of new experimental ML-DSA-44 post-quantum signature code reachable by an unauthenticated client in the default configuration — about 16 percent of sshd's pre-authentication code — even when an administrator had explicitly excluded the algorithm, because the server parsed whatever key type the client sent before checking whether it was allowed.

Anthropic reported the issue with patches, and OpenSSH 10.5 moved the check earlier. Claude then found two ways around it, including advertising ssh-ed25519 while slipping in an ML-DSA key, and getting sshd to deserialize an attacker-supplied certificate's CA key before consulting configuration. The final fix shipped in OpenSSH 10.6 on October 6, placing allow-list checks inside the key parser itself and removing about a fifth of the code an unauthenticated client could previously reach. The 10.6 release notes credit Rohlf "in collaboration with Claude and Anthropic Research."

Anthropic has packaged the three techniques — default-configuration reachability, pre-gate code tracing, and silent configuration interactions — into a reusable Claude skill it is working to integrate into OSS-Scanner, its free bug-scanning service for open-source maintainers. Every finding is confirmed with a dynamic trace, and any proposed gate must leave the project's own test suite and a black-box regression suite passing unchanged. The company published no cost figures for the effort, and the results are self-reported rather than independently reproduced.

The wider lesson sits in Rohlf's own framing: OpenSSH is among the most heavily audited codebases in the world, and unnecessary reachability survived there for years. If AI-assisted review can meaningfully shrink attack surface in that codebase, configuration-hygiene auditing across the long tail of under-audited open-source infrastructure is an obvious — and enormous — next target.