Anthropic: Claude maps and shrinks attack surface across 25 open-source projects, flagging 493 issues; OpenSSH 10.6 cuts unauthenticated reachable code by about a fifth

Why it matters

【Key points】

Anthropic's Frontier Red Team used Claude for automated attack-surface analysis on 25 open-source projects (5M+ lines) and found 493 issues.

1. Three checks: code reachable by default but unused, conflicting config combinations, sensitive code running before auth or protocol state.

2. 17,000+ config options inventoried (3,842 security-relevant); all 11 gated projects had unintended reachable code; 94 undocumented combinations silently disabled a control; one cert-check bypass sat for 21 years.

3. OpenSSH 10.4: ~4,500 lines of experimental ML-DSA-44 parsing (~16% of default pre-auth code) were reachable unauthenticated even when disabled; fixed in 10.6, cutting pre-auth reachable code by about a fifth.

4. Packaged as a three-pass Claude skill heading into OSS-Scanner.

【Verifiable】

https://www.anthropic.com/research/attack-surface-reduction

【Our read】

1. Background: shifts from finding bugs to making unknown ones unreachable.

2. Comparison: OpenAI's same-day PHP2Shell disclosure is the find-and-fix path; this is systemic hardening — complementary.

3. Impact: silent config failures evade audits and fuzzing; CI tooling here would be valuable.

4. Caveats: most issues aren't directly exploitable; projects besides OpenSSH unnamed; skill not public yet.