Claude helped close a fifth of OpenSSH's pre-auth attack surface, Anthropic says

Claude-assisted work removed roughly a fifth of the code an unauthenticated client could reach in a default OpenSSH build, according to Anthropic’s new research report. The notable idea is to put unnecessary code behind a gate before an attacker reaches it, even when no exploitable bug has been found in that code.

The October 20 report describes running Claude over 25 open-source projects spanning more than five million lines of code. Anthropic counts 493 issues involving default configurations, interactions between settings and code that executes too early. Those are not 493 independently confirmed vulnerabilities or successful exploits.

OpenSSH confirms the change; the size estimate is Anthropic’s

In the lab’s account, OpenSSH 10.4 could parse roughly 4,500 lines of experimental ML-DSA-44 code before deciding whether the supplied key algorithm was permitted. Moving an initial check earlier in 10.5 left gaps involving the algorithm encoded inside a key and a certificate’s embedded CA signature.

Anthropic says it worked with maintainers to place allowlist checks inside the parser, before the corresponding deserialization or signature verification. Its estimate of the final reduction is roughly one fifth of OpenSSH’s reachable pre-authentication code, predominantly the ML-DSA path.

There is separate maintainer evidence for the engineering change: OpenSSH 10.6’s release notes say key and CA signature types are checked against allowlists as early as possible to reduce exposure from disabled algorithms. They credit Chris Rohlf working with Claude and Anthropic Research. The notes do not independently establish Anthropic’s percentage estimate.

OpenSSH 10.6 was released October 6. This is a new research explanation of already shipped work, not a newly released OpenSSH version or a claim that every deployment’s exposure falls by the same amount.

Configuration interactions matter too

Across the wider study, Anthropic reports 162 security-sensitive combinations accepted without a warning or documented interaction; 94 silently disabled a security control. One example involved hostname-based access rules failing open when a separate reverse-DNS setting was off.

The proposed workflow uses three fresh-context passes for default reachability, early execution and configuration interactions. Anthropic says findings receive dynamic traces, while default-behavior changes must pass the project’s tests and a black-box regression suite. Changes affecting non-default configurations are left for human decisions.

The company says it is working to integrate a reusable skill into OSS Scanner. That describes planned integration, not general availability of a finished scanner feature. The report also supplies no per-project cost table, despite describing the approach as economical. Its practical contribution is a defense method and a maintainer-confirmed case study, rather than proof that automated review makes a codebase secure.