Anthropic used Claude to shrink code attack surface across 25 open-source projects

Using Claude to reduce the attack surface of code

Anthropic ran Claude over 25 open-source projects, more than 5 million lines of code, and found 493 issues. The review looked at unnecessary exposure under default configs, config combinations that weaken security controls, and code reachable before auth or protocol state checks. The method is packaged as a reusable skill. In OpenSSH, fixes shipping with 10.6 removed about a fifth of the code unauthenticated clients could previously reach in the default build.

Why it matters: It shows a concrete method for finding code reachable before authentication, with dynamic tracing and regression tests to filter fixes.