Anthropic's Frontier Red Team used Claude to examine 25 open-source projects written in C, C++, Java, PHP, and Python, totaling more than five million lines of code and an inventory of over 17,000 configuration options, 3,842 of them security-relevant.

The scan surfaced 493 issues involving unnecessary exposure, conflicting settings, and code running before security checks.

In 94 cases, configuration combinations were accepted without errors, warnings, or documentation while silently disabling security controls — findings reported by Help Net Security and TechRadar.

Some configuration interactions were severe. According to Help Net Security, in four unrelated projects, hostname-based access rules depended on a separate reverse-DNS setting — with lookups disabled, hostname deny rules failed to match, letting in connections administrators meant to block.

TechRadar describes the most striking case: one setting required clients to prove identity through certificates, while another, meant only to delay the check, disabled it entirely — two conflicting options accepted without any warning, and per Help Net Security they had coexisted in the software for 21 years.

OpenSSH was the case study.

Claude found roughly 4,500 lines of experimental post-quantum cryptography code — implementing the ML-DSA-44 signature algorithm — reachable by unauthenticated clients even when administrators had excluded the algorithm, because OpenSSH processed a supplied key before checking whether its type was permitted.

Anthropic supplied patches; OpenSSH 10.5 moved the check ahead of parsing, but Claude then found two gaps, including a client misrepresenting key type. Changes shipped in OpenSSH 10.6 placed checks inside the parser and cut code reachable before authentication by roughly a fifth in a default build.

This was not a hunt for individual vulnerabilities. Anthropic argues that searching for flaws one at a time is a Sisyphean task that scales poorly and never guarantees security.

"These techniques don't remove the unknown vulnerabilities in the code, but they do make the vulnerabilities harder to reach," wrote Anthropic's Chris Rohlf.

The surprising consensus-breaking idea is that a defender who reduces unnecessary attack surface reduces the risk from all unknown vulnerabilities in that code at once — including any already being quietly exploited — rather than waiting to discover each one.

Anthropic combined the techniques into a reusable Claude skill it is working to integrate into OSS-Scanner, its free, opt-in scanning service for open-source projects.

The skill checks for code exposed by default, functionality accessible before authentication or other security gates, and setting combinations that silently weaken protections.

Findings are verified through dynamic execution traces: for default-configuration findings, Claude implements proposed gates and compares modified builds against a baseline using the project's own tests and a black-box regression suite, requiring identical results.

Any gate that would change behavior under a non-default configuration is set aside for human review.

The findings land as AI sharpens both attack and defense.

App Developer Magazine notes that the same progress helping defenders find flaws gives attackers a way to investigate weaknesses around the clock, and that AI assistance helped uncover the critical PHP flaws CVE-2026-109618 and CVE-2026-109619 patched on October 21 in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

All 11 projects intended to restrict functionality to authenticated users contained code unintentionally reachable before authentication.

With AI-equipped attackers probing unpatched code, Anthropic's bet is that systematically limiting exposure — as OpenSSH 10.6 demonstrated — is the defense that scales.