Anthropic published research on Tuesday, October 20, 2026 describing how its Claude models can shrink the amount of code an attacker is able to touch, instead of chasing individual bugs one by one. The post, by Chris Rohlf of the company's Frontier Red Team, says Claude examined 25 open-source projects totalling more than five million lines of C, C++, Java, PHP and Python, and reported 493 issues. The most concrete outcome involves OpenSSH, whose maintainers shipped fixes in version 10.6 after Anthropic shared its findings and patches.
The premise is simple: a flaw that nobody has discovered yet does less harm if the code containing it cannot be reached. Anthropic looked for three patterns. The first is code left exposed by a project's shipped defaults even though no default feature uses it. The second is pairs of settings that look reasonable on their own but quietly cancel a protection when combined. The third is complex, security-sensitive code that runs before authentication, without any action by the victim, or ahead of a protocol state change. Putting that code behind a gate does not remove bugs, but it limits how much damage they can do.
Claude began by cataloguing more than 17,000 configuration options across the projects, 3,842 of which governed a security-relevant control or feature. Anthropic grouped the projects as public services, gated services meant for authenticated users, and private tools. All eleven gated projects contained code reachable when it should not have been. Anthropic counts 93 unneeded pre-authentication surfaces in default setups, 37 spots where code ran or state was recorded before login, and 61 setting combinations that weakened a pre-authentication control. The company says none of these was exploitable on its own.
Conflicting settings produced some of the most striking results. Claude found 162 security-relevant combinations accepted with no error, warning or documentation, and in 94 of them a protection was switched off silently. One flaw showed up in four unrelated projects: deny rules written with hostnames never match when reverse DNS lookups are disabled, so the list fails open. Elsewhere, two options interacted so that a server demanding client certificates would admit anyone, a conflict Anthropic says had been present for 21 years.
Measured as a share of code, OpenSSH saw the largest reduction. In release 10.4, Claude traced roughly 4,500 lines of new ML-DSA-44 post-quantum signature code that an unauthenticated client could hit under default settings, even when administrators had excluded the algorithm. Anthropic puts that at about 16% of the pre-authentication code in a default sshd. Version 10.5 moved the check earlier, but Claude then found two bypasses: a client could advertise one key type while sending another, and certificate CA signatures were verified before the configuration was consulted. After several rounds with the maintainers, the checks were moved into the parser itself. Anthropic says the 10.6 release cut about a fifth of the code reachable before login in a default build.
Anthropic has turned the method into a reusable Claude skill that runs three passes, each with a fresh context, confirms findings with dynamic traces and reruns a project's own tests to check that new gates leave default behaviour unchanged. Changes that would affect non-default configurations are set aside for a human. The company says it is working to bring the skill into OSS-Scanner.
The numbers come from Anthropic alone. The post does not name most of the 25 projects, say how many of the 493 issues maintainers accepted, or give false-positive rates or costs, and the OpenSSH work is the only fix it documents in detail.