Claude’s audit cut a fifth of OpenSSH’s pre-login code

In new research, Anthropic ran Claude over 25 open-source projects totaling more than five million lines of code and found 493 issues with needlessly reachable code. In 94 cases, two config options set together silently turned off a security control.

The biggest cut came in OpenSSH 10.4. Roughly 4,500 lines of experimental ML-DSA-44 code, a post-quantum signature algorithm, were reachable by an unauthenticated client even when admins excluded it.

After several fix iterations with the maintainers, the checks moved into the parser, removing roughly a fifth of the code an unauthenticated client could reach in a default build. The change shipped in version 10.6.

“If unnecessary reachability survives there, it can survive anywhere,” Anthropic wrote.