Anthropic Finds 493 Attack-Surface Issues in 25 Open-Source Projects

Anthropic’s Frontier Red Team used Claude to identify 493 attack-surface issues across 25 open-source projects containing more than five million lines of code. The research examined unnecessary exposure rather than individual exploitable vulnerabilities, finding 162 security-sensitive configuration combinations, including 94 that silently disabled security controls, alongside fail-open hostname-based deny rules. All 11 projects intended to restrict functionality to authenticated users exposed some code before authentication, though those findings were not immediately exploitable on their own.

In OpenSSH, unauthenticated clients could reach approximately 4,500 lines of experimental ML-DSA-44 cryptographic code even when administrators had excluded the algorithm. Claude also found bypasses in an initial mitigation; following an initial change in OpenSSH 10.5, additional fixes in OpenSSH 10.6 reduced code reachable before authentication by roughly one-fifth in a default build. Anthropic developed a reusable three-pass workflow that dynamically validates findings and tests proposed security gates for behavioral regressions. The findings highlight opportunities for maintainers and security teams to move checks ahead of complex processing and reject conflicting configurations without waiting for an exploitable vulnerability to emerge.