Most AI security news is about finding bugs. Anthropic's Frontier Red Team has published research on a different defence: using Claude to find code that attackers can reach but nobody needs them to reach, and putting it behind a gate. The appeal is that fixing one bug says nothing about the bugs that remain, while shrinking what an outsider can touch lowers the risk from every unknown flaw at once, including ones already being exploited quietly.
The team ran Claude over 25 open-source projects in C, C++, Java, PHP and Python, more than five million lines in all, looking for three patterns: code reachable in the default configuration that no default feature uses, pairs of settings that are harmless alone but dangerous together, and complex security-sensitive code that runs before authentication or before a user acts. Claude built an inventory of more than 17,000 configuration options, 3,842 of them security-relevant, and found 493 issues. All eleven projects meant to serve only authenticated users had code reachable before login. The most striking finding was 162 risky setting combinations accepted with no error, warning or documentation; in 94 of them, a security control was silently switched off. One example: requiring client certificates, combined with an option meant only to delay that check, actually disabled it, so a server set to accept only trusted clients would accept anyone.
The headline case is OpenSSH, some of the most heavily audited C in the world. In release 10.4, Claude found about 4,500 lines of new experimental code for ML-DSA-44, a post-quantum signature scheme, that an unauthenticated client could reach in the default setup even though the algorithm was not enabled. It then spotted two gaps in the partial fix in 10.5. The maintainers shipped the full changes in 10.6, removing roughly a fifth of the code reachable before authentication.
For security teams, this is a more durable use of AI than another round of bug hunting, and it fits the attack surface work that tools such as Claude Security are built around. Anthropic has packaged the method as a three-pass Claude skill it is adding to its open-source scanner.
The limits are stated plainly. None of the 493 issues was exploitable on its own; they widen exposure rather than open a door. Gating code that is reachable by default can break someone's workflow, so every change needs a maintainer's judgement, as the OpenSSH fixes received. And these are Anthropic's own results on projects it chose.