Anthropic Says Claude Found 4,500 Lines of Pre-Auth OpenSSH Code; OpenSSH's Notes Describe It as Off by Default

Anthropic's Frontier Red Team said on Oct. 20 that Claude found about 4,500 lines of experimental ML-DSA-44 signature code that unauthenticated clients could reach in a default OpenSSH 10.4 sshd. That is roughly 16% of the server's pre-authentication code, according to the post by Chris Rohlf. OpenSSH's release notes describe the same 10.4 feature as not enabled by default.

The two documents can both be true, and the gap between them is the useful part of the story. The rest of the post is a count of configuration problems across 25 open-source projects, with no figure for how many were confirmed.

What Anthropic measured

The study covered 25 projects, more than five million lines of code in C, C++, Java, PHP and Python. Ten were public, 11 gated and 4 private. Claude built an inventory of over 17,000 configuration options, 3,842 of them security-relevant, and reported 493 issues.

The approach is reachability rather than bug hunting. Rohlf's argument, in his words: "reducing code reachability can reduce the severity of unknown vulnerabilities." Three passes looked at default configuration, pairs of options that are unsafe together, and sensitive code that runs before authentication.

1. Silently disabled a security control94 combinations
2. Inconsistencies in security mechanisms68 combinations

Source: Anthropic, Using Claude to reduce the attack surface of code, Oct. 20, 2026

Those two bars sum to 162. The post says none of the issues in the gated projects "would have been immediately exploitable on their own." It reports no false-positive rate and does not say how many of the 493 were fixed.

The pattern that showed up in four unrelated projects

One finding repeated. Hostname-based deny rules failed open in four unrelated projects: with reverse DNS lookups off, a rule written against a hostname can never match an IP address, so the deny never fires.

In another case two options conflicted so that a required client-certificate check was silently dropped, and the post says the conflict had existed for 21 years. The post does not name that project.

The OpenSSH timeline

OpenSSH is the only named case study, and the timeline can be checked against the project's notes.

Release	Date	Per OpenSSH notes
10.4	Jul. 6, 2026	Experimental ML-DSA 44 plus Ed25519 composite signatures, not enabled by default
10.5	Aug. 11, 2026	Key type checked against allowed algorithms before parsing the peer's key
10.6	Oct. 6, 2026	Key and CA signature types checked against allowlists during parsing

The 10.4 notes call the scheme experimental and say it is off by default. Anthropic's post says the 4,500 lines were reachable by unauthenticated clients in the default configuration. A plausible reading is that the code was compiled in and parsed attacker-supplied data even where the algorithm itself was not enabled, but neither document says so, and that is an inference, not a finding.

The post says Anthropic reported the issue with patches and that 10.5 moved the check ahead of parsing. The 10.5 notes do say the project will "move check of public key type against allowed algorithms to before parsing of the key sent by the peer," which "removes at least some key parsing and verification paths from the pre-auth attack surface."

Then Claude found two gaps in that fix, per the post: an algorithm-name mismatch and an unguarded certificate CA signature path. The final change put checks inside the parser, removed roughly a fifth of what an unauthenticated client can reach in a default build, and shipped in 10.6. The 10.6 notes say the checks "reduce the attack surface presented by disabled algorithms." They do not credit Anthropic or give a percentage.

What this looks like in practice

The work was packaged as a Claude skill that is being integrated into OSS-Scanner. It runs three passes, each from a fresh context, confirms findings with dynamic traces and validates default-config gates against each project's test suite. Changes to non-default configurations are left for a human to decide.

That is close to the shape of Cloudflare's security-audit skill, which we covered earlier as another coding-agent skill for security review. Anthropic publishes no catch rate for its own. Readers tracking OpenSSH 10.6 can also see our OpenBSD 8.0 coverage.

The post names the model only as "Claude" and does not give a version, so the result cannot be rerun against a known checkpoint. The authors call it initial research offering "only a very limited view" of what is possible.

What to watch next: the integration into OSS-Scanner, and whether any of the 25 projects publish their own tally of the 493 findings.