OpenSSH — the program behind secure remote logins, some of the most heavily audited code on the planet — was quietly exposing 4,500 lines of experimental code to attackers who had not even logged in. Anthropic’s Frontier Red Team found it by pointing Claude at the code and asking a different question than every bug bounty asks.
The result came from a Claude OpenSSH red-team experiment published October 20, 2026, in which Anthropic researcher Chris Rohlf set Claude loose on 25 open-source projects totaling more than five million lines of code. Claude found 493 issues — and the biggest reduction, by share of codebase, came from OpenSSH.
The 493-issue sweep
Rohlf’s argument is blunt — fixing vulnerabilities one by one scales poorly, because fixing one critical bug tells you nothing about the bugs that remain. Shrinking reachability reduces the severity of unknown vulnerabilities all at once, including ones already under active exploitation. Anthropic ran Claude over 25 projects in C, C++, Java, PHP and Python:
Anthropic groups the 25 projects into three categories: Public (10), Gated (11) and Private (4). The Gated cohort held the surprises: all eleven had unintentionally reachable code — 93 unnecessary pre-authentication surfaces, 37 spots where code ran before authentication, and 61 config combinations silently weakening a pre-auth control.
The three patterns Claude hunted
Claude was not chasing individual bugs. It looked for three kinds of unnecessary exposure:
- Default configuration — code reachable by default that no default feature uses.
- Configuration interaction — setting pairs that quietly switch off a security control together.
- Early reachability — complex code running before authentication or interaction gates.
The configuration-interaction findings were the most unsettling. In 162 cases, projects accepted dangerous option pairs with no error, no warning and no documentation. In 94 of those, the combination silently turned off a security control. One conflict had sat in a codebase for 21 years: a server meant to accept only certificate-holding clients would accept anyone.
Another pattern appeared independently in four unrelated projects: hostname-based access rules compared against the client’s IP when reverse DNS lookups were off, so deny rules failed open.
The OpenSSH case: 4,500 lines nobody needed
The headline finding came from tracing the SSH daemon’s input paths in release 10.4. Claude found roughly 4,500 lines of new, experimental code for ML-DSA-44, a post-quantum signature algorithm — reachable by an unauthenticated client in the default configuration, even when the algorithm was explicitly disabled. The daemon parsed whatever key type the client sent before checking whether it was allowed. Those lines were about 16% of OpenSSH’s own pre-authentication code.
Anthropic reported it with patches. Release 10.5 moved the check before parsing — but Claude found two ways around that check, including a hidden ML-DSA key inside an acceptable certificate. After several rounds with the maintainers, the check moved inside the key parser itself, and OpenSSH 10.6 shipped the fixes on October 6, 2026. The release notes say the change “reduces the attack surface presented by disabled algorithms” and credit Rohlf “in collaboration with Claude and Anthropic Research” — roughly a fifth of the code an unauthenticated client could reach is gone.
Rohlf’s takeaway: “OpenSSH is some of the most heavily audited code in the world. If unnecessary reachability survives there, it can survive anywhere.” Anthropic packaged the technique into a reusable Claude skill now being integrated into OSS-Scanner.
Claude’s reusable three-pass audit
The same loop works on any codebase: shrink what attackers can reach before chasing individual bugs.
How to profit: sell AI red-team audits
Attack surface reduction is a new service category — and Anthropic just published the playbook:
- Offer “AI attack-surface audits.” Run Claude over a client’s codebase hunting the three patterns. Deliver a ranked report, not raw output.
- Audit OSS dependencies. Clients inherit every exposure in their dependencies. An audit of their top 20 dependencies is a fixed-price product.
- Scan before every release. Bake the three-pass loop into CI/CD as a recurring service: every release gets an attack-surface diff.
- Fix config pairs first. The 162 silent combinations are the cheapest wins: hardened configuration, no code changes.
- Sell the before/after. “We removed X% of your pre-auth attack surface” is a metric executives understand — and it renews contracts.
- Specialize in the long tail. If OpenSSH hid 4,500 unnecessary lines, every mid-size SaaS has worse. Small companies cannot afford a red team but can afford you.
Frequently asked questions
What did Claude find in OpenSSH?
About 4,500 lines of experimental ML-DSA-44 post-quantum signature code reachable by an unauthenticated client in the default configuration of OpenSSH 10.4 — roughly 16% of the daemon’s pre-authentication code — even when the algorithm was explicitly disabled.
How much did the fix reduce OpenSSH’s attack surface?
Roughly a fifth. The 10.6 changes remove about 20% of the code an unauthenticated client could reach in a default build, crediting Rohlf “in collaboration with Claude and Anthropic Research.”
What are the three attack-surface reduction methods?
Default configuration (code reachable by default but unused), configuration interaction (option pairs that weaken security together) and early reachability (complex code running before authentication gates).
Did Claude find vulnerabilities or just exposure?
Exposure, deliberately. Shrinking reachability reduces the severity of unknown vulnerabilities at once — including ones already being quietly exploited — without finding an individual bug.
What is the OSS-Scanner skill?
A reusable Claude skill combining the three techniques, being integrated into OSS-Scanner. It runs three passes per codebase, each with a fresh empty context window.
How can developers use this before shipping?
Run the loop on your own code and dependencies: list what the default config exposes, check what runs before authentication, and test config pairs for silent security-control shutdowns.
Keep Reading
Official sources: Anthropic research: “Using Claude to reduce the attack surface of code” by Chris Rohlf (Oct 20, 2026) and OpenSSH official site.