Intel / article

Attack Surface Reduction

Source: anthropic.com
Author: Anthropic research
Date: Published Oct 20, 2026

From the Daily Brief

Anthropic researcher Chris Rohlf describes using Claude for attack surface reduction: mapping which code a deployment can reach, then moving anything it does not need behind authentication, an opt-in flag or a later protocol state. Fixing one vulnerability says nothing about the ones that remain, while shrinking reachable code reduces the severity of all of them at once. Across 25 open-source projects totaling over five million lines in C, C++, Java, PHP and Python, Claude inventoried more than 17,000 configuration options and reported 493 issues. Every one of the eleven authenticated projects had code reachable before login. The most useful findings were configuration pairs accepted without warning that silently disabled a security control, 94 cases in all, including one certificate requirement that had been switched off by another option for 21 years. A repeated pattern in four projects made hostname-based deny rules fail open when reverse DNS was off. In OpenSSH, Claude found the new ML-DSA-44 parser reachable before the allow-list check, the maintainers moved the check in 10.5, and later fixes closed two bypasses, removing about a fifth of the code an unauthenticated client could reach. The pre-authentication findings were not exploitable on their own, which is the point: the method reduces exposure without needing a working exploit.

Read the 2026-10-21 Brief →

Key takeaways · AI-distilled

Anthropic reports Claude found 162 security-sensitive configuration combinations across the 25 projects that were accepted without error, warning or documentation; in 94 of them the combination silently turned off a security control.
In four unrelated projects, Claude found hostname-based access rules that fail open: with reverse DNS lookups off, the server compares the hostname pattern against the client's IP as text, so a deny rule never matches.
In OpenSSH 10.4, Claude found about 4,500 lines of experimental ML-DSA-44 signature code reachable pre-auth by default, even when admins excluded the algorithm, because sshd parsed the key before checking its type. That was about 16% of default pre-auth code.
Anthropic says the OpenSSH 10.5 fix still left gaps: the check used the client's advertised algorithm name rather than the type inside the key blob, and certificate CA signatures were verified before configuration was consulted. Version 10.6 moved the checks into the parser.

Read the source www.anthropic.com