Anthropic pointed Claude at 25 open-source projects and it came back with 493 issues. In a research post dated Tuesday, Oct. 20, 2026, Anthropic's Frontier Red Team (author Chris Rohlf) said Claude analyzed projects totaling more than five million lines of code in C, C++, Java, PHP and Python, looking for code that attackers can reach but a deployment doesn't need to expose. These are mostly not confirmed exploitable bugs: the goal is to shrink the "attack surface" so unknown bugs are harder to reach.

The key numbers

  • 17,000+ settings mapped: Claude inventoried more than 17,000 configuration options, 3,842 of them security-relevant.
  • 162 risky combinations: settings that were accepted with no error or documentation of how they interact. In 94 of those cases, the combination silently turned off a security control.
  • All 11 login-gated projects had code reachable before authentication that didn't need to be: 93 unnecessary pre-authentication surfaces in default settings, 37 places where code ran or state was recorded before login, and 61 setting combinations that silently weakened a pre-login control.
  • 21 years: one conflicting pair of options, which let a server meant to accept only certificate-holding clients accept anyone, had been in the software for 21 years, Anthropic said.

The OpenSSH case

In OpenSSH 10.4, Claude found roughly 4,500 lines of new, experimental code for the post-quantum signature algorithm ML-DSA-44 that an unauthenticated client could reach in the default configuration, even when an administrator had excluded the algorithm. That was about 16% of OpenSSH's own pre-authentication code in a default sshd. Anthropic reported it with patches; version 10.5 moved the check earlier, Claude then found two gaps in that fix, and the final changes shipped in OpenSSH 10.6. Anthropic says they removed roughly a fifth of the code an unauthenticated client could previously reach in a default build.

"OpenSSH is some of the most heavily audited code in the world. If unnecessary reachability survives there, it can survive anywhere," Anthropic wrote. The company is packaging the method as a Claude skill it plans to fold into its OSS-Scanner tool. AI Weekly notes the post gives no per-project severity breakdown or CVE list.

For more on AI and security, see OpenAI's disclosed agent incidents and the hacker who used AI agents to breach 100 companies.