Is the attack-surface skill available to use?

Not as a standalone download. Anthropic says the three techniques were packaged into a reusable Claude skill that the team is working to integrate into its OSS Scanner, the opt-in vulnerability-finding service for open-source projects. The research post describes the workflow and the results but does not publish the skill or a separate code release.

What kinds of projects did Claude find the most in?

Anthropic grouped the 25 projects as Public (10), Gated (11, requiring authentication) and Private (4). The gated group produced the sharpest findings: 93 unnecessary pre-authentication surfaces in the default configuration, 37 places where code ran or state was recorded before authentication, and 61 option combinations that silently weakened a pre-authentication control.

How is this different from normal bug hunting?

Normal vulnerability research finds and fixes individual bugs. Anthropic's attack-surface work instead asks which code an attacker can reach at all in a default install, and removes or gates the parts that no default feature uses. The claim is that unknown bugs in unreachable code stop mattering, so severity drops without anyone having to discover each bug first.

Who reviews the changes Claude proposes?

Anthropic says the skill confirms its findings with dynamic traces, and for default-configuration findings it adds a gate that checks the project's test suite and a black-box regression suite produce identical results. Any change that touches non-default configurations goes to a human for review rather than being applied automatically.

Anthropic · 2026-10-20 · major

Claude cuts attack surface — 493 issues across 25 open-source projects

Anthropic's Frontier Red Team used Claude to find code that a default deployment exposes but never needs. Across 25 projects and over 5 million lines, it reported 493 issues, including 4,500 lines of OpenSSH code reachable before authentication.

Anthropic research post header for using Claude to reduce the attack surface of code

Instead of hunting single bugs, Claude maps the code a default install exposes and argues for removing what nobody needs.

Quick facts

Maker	Anthropic Frontier Red Team (Chris Rohlf)
Scope	25 open-source projects, over 5 million lines of C, C++, Java, PHP and Python
Issues reported	493
Config options inventoried	Over 17,000, of which 3,842 security-relevant
Headline case	~4,500 lines of OpenSSH 10.4 post-quantum code reachable pre-auth
Shipped as	A Claude skill being integrated into Anthropic's OSS Scanner

What is it?

Attack surface reduction is the idea Anthropic's Frontier Red Team put to Claude: map the code a deployment can actually reach, then remove or restrict whatever that deployment does not need. The post, by Chris Rohlf, reports 493 issues across 25 open-source projects totalling more than 5 million lines. The argument is that this lowers the severity of vulnerabilities nobody has found yet, without having to find each one.

How does it work?

Claude ran three techniques. Default configuration looks for code reachable in the shipped setup that no default feature needs. Configuration interaction looks for option pairs that are each reasonable but unsafe together — 162 combinations were accepted with no warning, and 94 of those silently turned a security control off. Early reachability looks for sensitive code that runs before authentication or before a protocol state change. The packaged skill runs each pass in a fresh context window, confirms findings with dynamic traces, and gates default-configuration changes on the project's own test suite plus a black-box regression suite.

Why does it matter?

The OpenSSH case shows the payoff: about 4,500 lines of experimental ML-DSA-44 post-quantum signature code, roughly 16% of the pre-authentication code in a default sshd, were reachable by unauthenticated clients in OpenSSH 10.4. Version 10.5 moved the check earlier, Claude found two remaining gaps, and the parser-level fix shipped in OpenSSH 10.6 — removing about a fifth of the code an unauthenticated client could previously reach. One reverse-DNS pattern failed open in four separate projects, and one certificate-check conflict had been live for 21 years.

Who is it for?

maintainers and security engineers hardening a default deployment

Frequently asked questions

Is the attack-surface skill available to use?: Not as a standalone download. Anthropic says the three techniques were packaged into a reusable Claude skill that the team is working to integrate into its OSS Scanner, the opt-in vulnerability-finding service for open-source projects. The research post describes the workflow and the results but does not publish the skill or a separate code release.
What kinds of projects did Claude find the most in?: Anthropic grouped the 25 projects as Public (10), Gated (11, requiring authentication) and Private (4). The gated group produced the sharpest findings: 93 unnecessary pre-authentication surfaces in the default configuration, 37 places where code ran or state was recorded before authentication, and 61 option combinations that silently weakened a pre-authentication control.
How is this different from normal bug hunting?: Normal vulnerability research finds and fixes individual bugs. Anthropic's attack-surface work instead asks which code an attacker can reach at all in a default install, and removes or gates the parts that no default feature uses. The claim is that unknown bugs in unreachable code stop mattering, so severity drops without anyone having to discover each bug first.
Who reviews the changes Claude proposes?: Anthropic says the skill confirms its findings with dynamic traces, and for default-configuration findings it adds a gate that checks the project's test suite and a black-box regression suite produce identical results. Any change that touches non-default configurations goes to a human for review rather than being applied automatically.