A different job for the model
Most AI security announcements count vulnerabilities found. This one counts doors left open. Attack surface reduction means mapping the code a system exposes, then moving whatever a given deployment does not need behind a gate: behind authentication, behind an explicit opt-in, or deeper into a protocol session. Anthropic's argument is that fixing bugs one at a time scales poorly, because fixing a critical flaw says nothing about the ones still in the code. Reducing unnecessary code reachability can limit exposure to unknown vulnerabilities, including flaws in code that an unauthenticated client no longer needs to access. It does not eliminate the vulnerabilities themselves or guarantee that all attack paths have been closed.
That framing is convenient for a lab selling a model, and it is also testable in a way bug counts often are not. A shipped code change provides a more concrete basis for verification than a finding count alone, although its measured security impact still needs validation.
What the numbers actually say
The 493 figure needs its context. These are attack-surface findings, not 493 exploitable vulnerabilities. Anthropic states plainly that, for the gated projects, none of the pre-authentication findings "would have been immediately exploitable on their own." They are unnecessary exposures: code running before a login check, defaults that expose features nobody uses, and setting pairs that interact badly.
The configuration findings are the strongest part of the report. Across all 25 projects, Claude found 162 undocumented security-sensitive configuration combinations that were accepted with no error or warning and no documentation of how they interact. In 94 of them, the combination silently turned a security control off. In the remaining 68, the behaviour was inconsistent in quieter ways: a listener stayed reachable after the configuration said it was disabled, or which setting won depended on their order in the file. One pattern appeared independently in four unrelated projects, where a deny rule written with hostname patterns could never match a client when reverse DNS lookups were off, so the list failed open.
In one unnamed project, Anthropic says a pair of accepted configuration settings could silently disable a required client-certificate check. As a result, clients without the expected certificate could connect to a server configured to require one. The conflicting settings had reportedly existed for 21 years.
The gated cohort is the uncomfortable read for anyone running authenticated services. Separately from the cross-project totals, within the 11 projects intended to require authentication, Anthropic reports 93 unnecessary pre-authentication surfaces in default configurations, 37 locations where code executed, or state was recorded, before authentication, and 61 configuration combinations that weakened pre-authentication protections. The report does not explicitly establish how those gated-project counts overlap the broader totals, and the gated figures should not be added to the totals above or to each other.
OpenSSH is the receipt
The case study carries the piece because it ends in a shipped fix, not a claim. In OpenSSH 10.4, Claude traced about 4,500 lines of ML-DSA-44 post-quantum signature code that an unauthenticated client could reach in the default configuration, even though the algorithm was not enabled and even when an administrator had explicitly excluded it. The daemon parsed whatever key type a client sent, and verified certificate signatures, before checking whether that type was allowed. That code is roughly 16% of OpenSSH's own pre-authentication code in a default sshd.
The 10.5 release moved the check before parsing. Claude then found two gaps in that fix: the check read the algorithm name a client advertised, while the parser followed a type string inside the key itself, so a client could advertise one algorithm and send another; and the certificate path verified an embedded CA signature for any supported algorithm before consulting the configuration. The final fix, shipped in OpenSSH 10.6, puts the checks inside the parser, before deserialisation or signature verification. Anthropic estimates that this removed roughly a fifth of the code an unauthenticated client could previously reach in a default build. That is a different measurement from the 16% above, which described the ML-DSA-44 code's share of pre-authentication code in 10.4 — not a fifth of OpenSSH's source code, and not a fifth of anything's vulnerabilities.
Anthropic identifies OpenSSH 10.6 as the release containing the fix, providing a concrete upstream change to examine; the reported reduction in reachable code remains Anthropic's measurement. OpenSSH's own 10.6 release notes describe the change in upstream terms: sshd and ssh now check key and CA signature types during key parsing against allowlists such as PubkeyAcceptedAlgorithms, as early as possible, reducing the attack surface presented by disabled algorithms. The notes credit the change to Chris Rohlf, in collaboration with Claude and Anthropic Research.
OpenSSH is heavily audited C code maintained for decades. If 4,500 lines of experimental parsing sat reachable there, the same class of problem in less scrutinised projects is not a stretch.
The skill checks its own work
Anthropic says it has assembled the three analysis passes into a reusable Claude skill and is working to integrate that skill into OSS-Scanner. The research post does not establish public availability of the skill or a release date for the integration.
The workflow Anthropic describes is more than a code read. In every pass, Claude inventories a codebase's entry points and confirms each finding with a dynamic trace of the running program. For default-configuration findings, it designs and implements a gate, then runs the project's own test suite plus a black-box regression suite against the baseline, requiring modified builds to produce identical results. Any proposed gate that would change a non-default configuration is set aside for a human to decide. That verification loop, attributed to Anthropic like everything else in this section, is the part another engineering team could most plausibly reproduce.
What is missing from the report
Three gaps matter before anyone generalises from this. Anthropic names only OpenSSH among the 25 projects, so there is no per-project breakdown, no severity grading, and no count of how many of the 493 findings upstream maintainers accepted. Anthropic identifies OpenSSH 10.6 as the release containing the fix; the other 24 projects are, on the published evidence, Anthropic's own tally. The method also has a stated ceiling, in Anthropic's own words: the techniques "don't remove the unknown vulnerabilities in the code, but they do make the vulnerabilities harder to reach." Harder to reach is a real gain. It is not a count of bugs prevented, and any vendor who later quotes it that way should be corrected.
The practical test for readers is narrow: run the same three questions against one system you operate. Which code is reachable in the default configuration that no default feature uses, what runs before authentication, and which of your setting pairs have never been tested together. The 94 configuration combinations that silently disabled a control suggest the third question is the one most teams have not asked.
Sources
- [1] Anthropic, "Using Claude to reduce the attack surface of code", Chris Rohlf, Frontier Red Team, anthropic.com, 20 October 2026 (primary source, read in full first-hand for this article; source for the 25-project scope, the option inventory, the 493 findings, the 162/94/68 configuration combinations, the gated-cohort figures, the 21-year pair, the OpenSSH account and all of Anthropic's measurements)Read source
- [2] OpenSSH 10.6 release notes, openssh.org, released 6 October 2026 (upstream primary documentation, read first-hand for this article; the notes list sshd(8)/ssh(1) checking key and CA signature types during key parsing against allowlists "as early as possible", reducing "the attack surface presented by disabled algorithms", and credit the change to Chris Rohlf in collaboration with Claude and Anthropic Research; confirms the release and the change, not Anthropic's percentages)Read source
- [3] Help Net Security, "Anthropic finds 94 cases where open-source projects drop security controls without warning", 22 October 2026 (secondary coverage)Read source