Anthropic uses Claude to map unnecessary code exposure across 25 open-source projects

The research shifts AI security work toward configuration interactions and code reachable before authentication, with OpenSSH fixes among the examples.

Anthropic has published research into using Claude to reduce the amount of software an attacker can reach, extending its AI security work beyond finding individual vulnerabilities. The 20 October study examined 25 open-source projects representing more than five million lines of code and reports 493 issues across several languages.

The approach starts with a deployment question: which parts of a program need to run for the functionality that an operator has actually enabled? A feature can be disabled in a settings file while its parser remains reachable. Two reasonable-looking options can interact in a way that removes a protection. Complex code can also run before the authentication or protocol step that should restrict access to it.

Configuration becomes part of the program

Anthropic organised the investigation around three areas: default exposure, interactions between configuration options, and code that becomes reachable too early. Claude inventoried more than 17,000 options, identifying 3,842 associated with security-relevant controls or features.

This is a different unit of analysis from a conventional bug report. Rather than beginning with a crashing input, the investigator traces an input from the network or file boundary to the checks that are supposed to govern it. The result can be a proposed change in ordering: reject an unwanted algorithm before parsing its key material, for example, instead of checking the configuration after the expensive or risky operation.

The company describes repeated patterns involving hostname-based access rules and reverse-DNS settings, as well as certificate requirements that disappeared on particular configuration paths. These examples show how a service's effective behaviour can depend on relationships among options, not simply on whether each option appears in its documentation.

The OpenSSH example

In one case study, Claude examined OpenSSH 10.4 and found that an unauthenticated client could reach roughly 4,500 lines of experimental ML-DSA-44 signature code even when the algorithm was excluded by configuration. Anthropic says subsequent work with maintainers moved checks earlier and addressed differences between an advertised algorithm and the type embedded in a key.

The final changes described in the research shipped in OpenSSH 10.6. Anthropic estimates that they removed about a fifth of the code previously reachable before authentication in a default build. That is a reachability result; the company is not claiming that every line removed from that path contained a vulnerability.

For maintainers, the interesting engineering pattern is placing the decision close enough to the parser that alternate call paths cannot skip it. A check at the outer request handler may cover the normal path while leaving certificate processing or another embedded format able to reach the same implementation.

A repeatable maintenance workflow

Anthropic has combined its method into a three-pass Claude skill that it is working to integrate with OSS-Scanner. The described process starts each pass with fresh context, traces entry points, and uses dynamic program traces to check findings. Default-behaviour changes are compared with the baseline using the project's tests and an additional black-box regression suite. Changes affecting non-default deployments are set aside for human decisions.

This makes the research relevant to established software as well as new agent products. A release can accumulate unused protocol handlers, optional formats and multiple configuration namespaces over years. Mapping the routes into that code gives maintainers a concrete way to reduce exposure while preserving the capabilities their users rely on.

The full research account includes the methodology, examples and upstream release reference, giving engineering teams a starting point for examining their own deployed configuration rather than treating an AI-generated vulnerability list as the final deliverable.

Sources

- [Using Claude to reduce the attack surface of code](https://www.anthropic.com/research/attack-surface-reduction) — Anthropic