Using Claude to reduce the attack surface of code

What happened

Anthropic's Frontier Red Team used Claude to analyze 25 open-source projects in C, C++, Java, PHP, and Python with the goal of reducing attack surface — limiting code reachable by an attacker without hunting individual CVEs.

Context and impact

The methodology targets reducing the blast radius of future unknown vulnerabilities, not finding them one by one. Anthropic is integrating the 3-pass Claude skill into the OSS-Scanner toolchain.

Details

• 493 total findings across 25 projects (5+ million lines of code)
• 93 unnecessary pre-authentication surfaces in default configurations
• 162 security-sensitive option combinations accepted without warning
• OpenSSH: 4,500 lines of post-quantum code reachable by unauthenticated clients; patched in version 10.6
• A 21-year-old conflicting TLS option silently dropped a certificate requirement