Anthropic’s Frontier Red Team used its Claude AI model to analyze 25 open-source projects and found 94 cases where configuration conflicts silently disabled security controls, along with 493 broader security issues spanning unnecessary exposure, conflicting settings, and code reachable before authentication.
Anthropic sorted the 25 projects into three categories: public services open to anyone, gated services requiring login, and private tools for an operator’s own environment. This categorization helped researchers expect broad default reachability in public projects but the opposite in gated ones. All eleven gated projects contained code unintentionally reachable before login, including 93 unnecessary pre-authentication surfaces, 37 locations where code executed or saved state before authentication, and 61 combinations that silently weakened a pre-authentication control.
The review identified 162 security-sensitive configuration combinations that systems accepted without errors, warnings, or documentation – 94 of which turned off a security control entirely. In one case, conflicting settings allowed a server to accept connections from anyone without administrator warnings, a flaw that had persisted for 21 years.
Claude’s analysis of over five million lines of code in C, C++, Java, PHP, and Python uncovered these issues by examining more than 17,000 configuration options, of which 3,842 were security-relevant. For example, four projects had hostname-based deny rules that depended on a reverse DNS lookup setting most projects had disabled, causing the rules to fail open and compare hostnames against client IP addresses as plain text.
Anthropic’s research also found roughly 4,500 lines of experimental ML-DSA-44 post-quantum signature code in OpenSSH’s default build – representing about 16% of pre-authentication code – even when OpenSSH excluded the algorithm. While OpenSSH 10.5 moved the check before parsing to address the issue, Claude identified gaps where clients could misrepresent key types or bypass certificate processing before configuration checks took effect. Anthropic reported these findings to OpenSSH, which patched the vulnerabilities.
Anthropic cautioned that the results come from a preview rather than independent testing. The company also said the techniques only make unknown vulnerabilities harder to reach and cut their severity.
Dynamic execution traces confirm Claude’s findings, and for default configurations, compare modified builds against a baseline built from the project’s own tests plus a black-box regression suite demanding identical results. Gates that would change non-default configuration behavior await human review, while other passes propose moving checks, enforcing state ordering, or rejecting conflicting settings.
Anthropic said Claude can match runtime logs against configurations to spot unneeded features operators might remove, Anthropic said, naming unused parsers, older protocols, and dashboards. This extends the method beyond static code analysis into operational observation of running systems.
Chris Rohlf wrote, “These techniques don’t remove the unknown vulnerabilities in the code, but they do make the vulnerabilities harder to reach”. Anthropic emphasized that if unnecessary reachability persists in OpenSSH – among the most heavily audited code in the world – it can survive in any project. The company framed attack surface reduction as a complement to traditional vulnerability fixing rather than a replacement.
Configuration interactions – where one setting overrides or ignores another – are especially significant because they often go undocumented and unnoticed until an audit like Claude’s surfaces them. For instance, TLS client certificate requirements were silently ignored on endpoints using a different namespace, allowing certificate-less clients to open sessions without logs.
Halvar Flake, a security researcher, said, “Attack surface reduction is the one thing that reliably works”. Anthropic has combined the three techniques into a reusable Claude skill that it’s working to integrate into OSS Scanner.
Anthropic launched OSS Scanner as a free, opt-in service for open-source projects to receive thorough periodic scans using its strongest AI models. Maintainers enroll by submitting a GitHub pull request with a YAML file listing the repository link, a primary contact e-mail, and a Dockerfile path. The auditing agent builds and scans the project offline without internet access. Maintainers had submitted 116 pull requests as of the article.
OSS Scanner generates fully model-driven reports with no human review or triage, meaning findings may be incorrect or invalid. Anthropic does not plan a 90-day disclosure period for scanner-generated reports due to false positive risks, though manually validated reports may be disclosed under its Coordinate Vulnerability Disclosure (CVD) program starting 90 days after human validation. The company may impose disclosure periods on high-severity vulnerabilities in the future as confidence in scanner performance grows.
Anthropic’s broader vulnerability reporting activity has identified over 29,000 candidate vulnerabilities in important software projects, with more than 6,000 flaws reported to maintainers and 584 advisories issued as of October 2, 2026. The company’s Critical Infrastructure Defense Program further emphasizes its commitment to protecting open-source software and critical infrastructure by leveraging AI to counter threats at machine speed.
Join the discussion