Anthropic finds 94 cases where settings silently drop security controls
Original title: Anthropic finds 94 cases where open-source projects drop security controls without warning
Claude’s review of 25 projects also found pre-authentication code paths; OpenSSH 10.6 cut that reachable code by about a fifth.
Anthropic’s Frontier Red Team used Claude to examine 25 open-source projects and reported 493 issues involving unnecessary exposure, conflicting settings, and code that runs before security checks. In 94 cases, accepted setting combinations silently disabled a security control, including hostname deny rules and a client-certificate requirement. In OpenSSH, unauthenticated clients could reach excluded ML-DSA-44 code; checks moved earlier in 10.5 and 10.6. Anthropic is packaging the method as a Claude skill for OSS Scanner.
Unconfirmed: Anthropic says the pre-authentication findings were not immediately exploitable on their own; no vulnerability was identified in the excluded OpenSSH code.
- All 11 projects meant to require authentication still exposed code before login.
- Claude identified 162 security-sensitive configuration combinations accepted without warning.
- Anthropic said one conflicting certificate option had existed for 21 years.
- OpenSSH 10.5 moved a key-type check earlier, but two gaps remained until 10.6.
- Anthropic said the findings in the authentication group were not immediately exploitable alone.
Impact: unauthenticated clients could reach excluded cryptographic code
| Product | Affected | Fixed in |
|---|---|---|
| OpenSSH | — | OpenSSH 10.6 |
- 1.Compare runtime logs with configuration and disable unused parsers, legacy protocols, and dashboards.
- Products
- OpenSSHOSS Scanner
- Organizations
- Anthropic
- AI models
- Claude
From the original article
3 min read at helpnetsecurity.com
Software can expose complex functionality to unauthenticated users even when that functionality is disabled or unnecessary. Anthropic’s Frontier Red Team used Claude to examine 25 open-source projects and reported 493 issues involving unnecessary exposure, conflicting settings, and code running before security checks. Attack surface reduction means limiting the parts of software an attacker can reach.
By Anamarija Pogorelec · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.