Finding the next CVE scales poorly. Anthropic's Frontier Red Team spent a research cycle asking Claude to shrink how much code an unauthenticated client can touch before anyone names a vulnerability.
On 20 October 2026, the lab posted "Using Claude to reduce the attack surface of code," credited to Christopher Paul Rohlf on the Frontier Red Team. The spine is reachability: inventory entry points, confirm them with dynamic traces, then move sensitive code behind authentication, configuration gates, or later protocol states. The OpenSSH trail is where the post leaves the lab and enters maintainer release notes.
Anthropic publishes attack-surface reduction after a year of offensive capability writeups
Anthropic's cyber posts over the past year emphasised discovery and exploitation. This piece flips the ledger toward defence that does not require fixing a named bug. The authors argue that reducing unnecessary reachability lowers severity for unknown vulnerabilities at once, including bugs already under quiet exploitation.
They ran Claude across 25 open-source projects in C, C++, Java, PHP, and Python, covering more than five million lines of code. Claude inventoried more than 17,000 configuration options; 3,842 were tagged as security-relevant controls or features. Projects were bucketed as Public (serve anyone who can reach them), Gated (functionality after authentication), or Private (operator's own environment). The post counts 10 Public, 11 Gated, and 4 Private. Those buckets matter for reading the charts: Public code is expected to expose a large default surface; Gated projects are where unintentional pre-auth reachability is the surprise.
Three methods, 493 issues, and an OpenSSH ML-DSA pre-auth surface
The methods are specific. Default configuration means code reachable in the shipped default even though no default feature needs it. Configuration interaction covers option pairs that silently disable a control, leave behaviour undefined, or keep code reachable while a setting claims otherwise. Early reachability is sensitive code that runs before authentication, without victim interaction, or before a protocol state transition.
Claude reported 493 issues. In the Gated cohort, the post cites 93 unnecessary pre-authentication surfaces in default configuration, 37 locations where code ran or state was recorded before authentication, and 61 configuration combinations that silently weakened a pre-authentication control. The Gated cohort carried the densest early-reachability findings on Anthropic's breakdown chart.
Across project types, 162 security-sensitive configuration combinations were accepted without error or warning and without documented interaction behaviour. In 94 of those cases the combination silently turned off a security control. The other 68 were inconsistencies inside the same security mechanism: a listener remaining reachable while marked disabled, order-dependent precedence between settings, or a configured protection that did nothing while its code stayed live.
One recurring pattern appeared in four unrelated projects: hostname or wildcard deny rules compared against client identity while reverse DNS lookups stayed off, so the server compared a hostname pattern to a raw IP string and the deny list failed open. Some projects documented that hostname rules need DNS lookups; none stated that a deny list written that way would fail open.
The post also describes a 21-year-old configuration conflict pattern in one project where requiring client certificates could be paired with an option that was meant only to delay the check and instead disabled it entirely, accepting anyone while exposing request-handling code that should have stayed behind the certificate gate. Another finding: a TLS client-certificate requirement honored on most endpoints but silently ignored on a few that loaded TLS settings through a different configuration namespace, with no log line when the shorter example form was dropped.
The OpenSSH case study is the detailed receipt. On OpenSSH 10.4, Claude traced sshd input paths and found roughly 4,500 lines of experimental ML-DSA-44 post-quantum signature code reachable by an unauthenticated client in the default configuration, about 16% of OpenSSH's own pre-authentication code in a default sshd on Anthropic's count. ML-DSA was disabled by configuration, yet the daemon parsed the client-offered key type (and verified embedded CA signatures for certificates) before consulting allow lists.
Anthropic reported the issue with patches. OpenSSH 10.5 moved the check before parsing. Claude then found two gaps in that 10.5 check: algorithm-name advertisement could disagree with the type string inside the key blob, and certificate CA signature verification could still reach verifiers before configuration consult. Maintainers iterated; OpenSSH 10.6 placed checks inside the parser so encoded key type and CA signature algorithm are compared against configured allow lists before deserialization or signature verification. Anthropic says that removed roughly a fifth of the pre-auth reachable code in a default build, almost all of it the ML-DSA path.
OpenSSH 10.5 and 10.6 release notes credit Rohlf with Claude and Anthropic Research
The public OpenSSH portable release notes match the collaboration claim. OpenSSH 10.5 (changes since 10.4) records that sshd moved the public-key type check against allowed algorithms to before parsing the peer key, "removing at least some key parsing and verification paths from the pre-auth attack surface," suggested by Christopher Paul Rohlf of Anthropic. The same notes credit Rohlf at Anthropic on related cleanup.
OpenSSH 10.6, released 6 October 2026, states that sshd and ssh now check key and CA signature types during key parsing against allowlists (PubkeyAcceptedAlgorithms and related) as early as possible, "reducing the attack surface presented by disabled algorithms," with extensive feedback from Christopher Paul Rohlf in collaboration with Claude and Anthropic Research. Separate 10.6 notes also credit Rohlf with Claude and Anthropic Research on an AuthorizedPrincipalsFile "none" handling fix.
That credit line is the independent document trail for the case study. It does not reproduce Anthropic's 4,500-line measurement; it does confirm maintainers shipped the gating direction the research describes.
Reachability gates beat waiting for the next named CVE
The operational rule Anthropic is selling is procedural. Pass one: default-configuration reachability, with gates that preserve default behaviour under the project's test suite plus a black-box regression suite. Pass two: code that runs before hard gates in any configuration. Pass three: configuration combinations that silently degrade controls. Each pass starts with an empty context window except for a short handoff from the prior pass; findings need a dynamic trace. Gates that would change non-default configuration are set aside for humans.
For gated daemons and pre-auth parsers, the Monday translation is blunt: parse and verify only after allow lists say the algorithm is in scope. Configuration pairs that disable certificates, authentication, or deny lists without a warning belong on the same punch list as memory-unsafe parsers.
Four hundred ninety-three issues are reachability findings, and the full project roster stays unpublished
Anthropic does not present the 493 items as a CVE list. Many findings are unnecessary surfaces or silent control drops rather than demonstrated exploits. The OpenSSH narrative includes a proof of concept for the 10.5 gaps inside Anthropic's writeup; Frontier did not re-run that PoC for this article.
The post does not publish a named inventory of all 25 repositories beyond the OpenSSH case and category counts. Star counts, severity scores, and time-to-fix metrics for the wider set are absent. Comparative performance against other models or classical static analysis on the same corpus is unsettled here.
OSS-Scanner skill timing and the unnamed 24 projects remain open
Anthropic says the three-pass method is packaged as a reusable Claude skill headed for integration into OSS-Scanner. Public release timing for that skill is unset on the post. Organisations that want the workflow today must rebuild from the described methodology or wait for the scanner integration.
Also missing: the full project list, per-project issue tables, and third-party audit of the dynamic-trace harness. Until those land, treat OpenSSH 10.5/10.6 as the verified external receipt and the 493 count as Anthropic's internal tally.