Anthropic's Frontier Red Team: Claude found 493 attack-surface issues across 25 open-source projects

Anthropic published "Using Claude to reduce the attack surface of code" on Oct 20, 2026. Everything below is Anthropic's own account.

• Idea: use Claude to map reachable code and gate or remove what a deployment does not need, which reduces the severity of unknown vulnerabilities without finding each one.
• Study: Claude analyzed 25 open-source projects (over five million lines, in C, C++, Java, PHP and Python) and reported 493 issues from three methods: default configuration, configuration interaction and early reachability. Among them, 162 security-sensitive option combinations had no warning or documentation, and in 94 of them a combination silently turned off a security control.
• OpenSSH: Anthropic says Claude found about 4,500 lines of experimental ML-DSA-44 code reachable by an unauthenticated client in a default sshd, around 16% of its pre-authentication code. It reported the problem with patches; the fix moved the key-type checks before parsing and shipped in OpenSSH 10.6, removing roughly a fifth of the code an unauthenticated client could reach.
• Tooling: Anthropic has packaged the method as a reusable Claude skill and says it is working to integrate it into OSS Scanner.

The Hacker News thread had 103 points and 66 comments by October 20.