Using Claude to reduce the attack surface of code

Anthropic applied Claude to 25 open-source projects totaling over five million lines of code and found 493 attack-surface issues, including code reachable before authentication and configuration combinations that silently disabled security controls. In the OpenSSH case study, about 4,500 lines of experimental ML-DSA signature code were reachable by unauthenticated clients in the default configuration, and fixes shipped in OpenSSH 10.5 and 10.6. This matters because shrinking the attack surface reduces the risk from unknown vulnerabilities all at once, rather than fixing bugs one by one, and Anthropic has packaged the method as a reusable Claude skill.

• Anthropic Research2026-10-20 00:00