Anthropic shows Claude cutting needless code exposure, including in OpenSSH

Anthropic's Frontier Red Team ran Claude over 25 open-source projects, more than five million lines of code, looking for code that attackers can reach but that does not need to be exposed. Claude reported 493 issues, including 162 risky setting combinations accepted with no warning; in 94 of them the combination quietly switched off a security control. In OpenSSH it found about 4,500 lines of experimental ML-DSA-44 code that an unauthenticated client could reach even when the algorithm was not enabled; after Anthropic reported it with patches, fixes shipped in OpenSSH 10.5 and 10.6. Anthropic is turning the method into a reusable Claude skill for OSS-Scanner. On Hacker News (130 points, 85 comments, 15 top-level commenters when we checked), most comments were not about the method. The biggest camp complained that Claude's cyber safeguards block defensive work, and one commenter said they switched to GLM 5.3 to investigate the PHP flaws because Claude and Codex balked. Others doubted lab security claims in general, one citing a kernel developer who says many AI-found kernel bugs were not real issues or were already fixed. One commenter gave one hands-on report, using the same idea to move features of their editor project behind Rust feature flags. No consensus on the post itself. Sorted take: shrinking what is reachable is cheap defence that also helps against bugs nobody has found yet. The thread's complaint is worth planning for too: if an AI tool's safeguards block your security work, know your fallback before an urgent patch day.