Claude looks for unused paths in software security
attack surface
The code and features that outside input can reach.
authentication
A check that confirms who is allowed to use a system.
configuration option
A setting that changes how software behaves.
What happened
On October 20, 2026, Anthropic (the AI company that makes Claude) published a study about reducing software’s “attack surface.” The term means the code and features that outside input can reach. Anthropic’s goal was not to show attack steps. It was to find unnecessary reachable code and place it behind better controls.
Anthropic says Claude examined 25 open-source projects with more than five million lines of code. It catalogued more than 17,000 configuration options. Of those, 3,842 related to security controls or features. The study reported 493 issues. They fell into three broad patterns: unused code reachable under default settings; combinations of settings that quietly weakened a protection; and complex or security-sensitive code reachable before an important gate, such as authentication.
All 11 projects in the study’s gated group had some unintentionally reachable code, Anthropic says. That does not mean every finding was an immediate attack. It means the software exposed more code than its intended setup required.
Why this problem exists
Software grows in layers. New features, dependencies, and settings can stay for years. A feature can be turned off while related code remains reachable. Two settings can look safe separately but interact badly. Checking every path and combination by hand becomes difficult in a large project.
Anthropic says the reusable Claude skill makes three passes. It checks entry points with dynamic traces and runs project tests. Potentially behavior-changing changes go to human review.
Why it matters
Fixing one known bug does not reveal every unknown bug. Reducing unnecessary reachability can limit the impact of many unknown problems at once. It does not remove those problems. It narrows the code that can be reached.
OpenSSH, a widely used secure remote-access program, became the study’s main case. Anthropic says Claude found about 4,500 lines of experimental code reachable before authentication in the default setup. The company reported the finding to OpenSSH maintainers. Version 10.5 moved an earlier check, and version 10.6 shipped the related changes. Anthropic says the final change removed roughly one-fifth of the code reachable before authentication in a default build.
What is confirmed
The confirmed record is Anthropic’s published method, its reported numbers, and its account of the OpenSSH fixes. A Hacker News discussion reached 94 points and 55 comments. Those figures measure community attention. They do not prove the research is correct. The original study and the discussion are separate sources of information.
What remains unknown
The material provided here does not show an independent reproduction of all 493 findings. It also does not show how serious each finding would be in a real product. The projects were selected for this study, so the results may not represent every codebase. We also do not know how often proposed changes will be accepted or whether later reviews will find missed cases.
What to watch next
Anthropic says it is working to integrate the method into OSS-Scanner. The useful tests will be outside the announcement: maintainers reviewing the changes, independent researchers checking the results, and regression tests showing that needed behavior still works. The larger question is practical. Can AI repeatedly help teams remove unnecessary exposure while humans remain responsible for the final decision?
Claude checks software for doors nobody meant to leave open
📰 Full story: Claude looks for unused paths in software security
Anthropic says Claude can help make large software safer.
attack surface
The part of software that outside input can reach.
open-source
Software whose code is available for people to inspect.
OSS-Scanner
A tool Anthropic says it may use for this method.
💡 The gist
- Anthropic, the company that makes Claude, published new research.
- Claude checked 25 open-source software projects.
- Anthropic reported 493 issues for people to review.
Software grows over time. New features and settings join older code. Sometimes unused code stays reachable from outside. This adds to the “attack surface.” The attack surface is the part outsiders can reach.
Claude looked for three patterns. First, default settings exposed code nobody needed. Second, settings could weaken a protection when combined. Third, some complex code ran before an important security check.
The projects contained more than five million lines. Claude listed over 17,000 configuration options. Anthropic says 3,842 involved security controls or features. Large projects are hard to inspect by hand. That is why a tool that maps many paths could help.
Software teams often fix bugs one at a time. That helps with known problems. It says little about code nobody has checked. A broad scan asks a different question: which code needs to be reachable at all?
OpenSSH is software for secure remote computer access. Anthropic says Claude found about 4,500 lines of experimental code reachable too early. Maintainers reviewed the finding. OpenSSH 10.6 included related fixes. Anthropic says the final change reduced the reachable code by about one-fifth.
Why does this matter? Finding every bug is difficult. Closing unused paths can limit unknown problems too. It does not delete every bug. It reduces what those bugs can reach.
Anthropic says Claude checked changes with project tests. People still decide changes that could alter behavior. That human review matters.
The Hacker News post received 94 points and 55 comments. These numbers show attention. They do not prove the study is correct.
The study is Anthropic’s own report. We do not yet have independent checks for all 493 findings. We also do not know their real-world severity. Anthropic is working to add the method to OSS-Scanner. Future reviews and tests will show how useful it is.
💬 What commenters said about using Claude to make code safer
Commenters saw both promise and frustration: Claude may help make code smaller and easier to check, but its safety rules may stop people who are trying to protect their own systems. The results and numbers are reports or opinions from commenters, not independent tests.
- Some users say Claude stops them from checking their own programs, fixing problems, or making a small working demonstration that proves a fix works. They say another wording sometimes helps, but this is only a user report.
- Another comparison report said Claude and GPT refused the check, Grok refused the working demonstration, and GLM-5.3 and Kimi finished it. The systems were not tested under the same controlled conditions.
- This leads to a complaint that attackers can use other AI while defenders are blocked. A different commenter says powerful abilities may spread to public models in about three months, so safety rules can still give important systems time to prepare. That three-month figure is only one person’s estimate.
- People also disagree about using a paid private model versus running an open model yourself. Smaller teams may prefer a cheap service and avoid being locked in; larger companies may have the staff and money to manage an open model.
- The Vix IDE author says Claude’s Fable, Opus, and Sonnet split the project into Rust parts and feature switches over one weekend, making it easier to choose capabilities and inspect them. This is the author’s own report.
- One commenter cited a claim that many of Mythos’s 79 reported kernel problems were not real problems or had already been fixed. Some people therefore want experts to check AI claims carefully. Formal proof methods may help too, but others say many connected parts can still behave unexpectedly.
initial digest at 55 comments (revision 1). We fetched 57 comments and sampled 57 across the thread. These are HN users’ reports, not independently verified facts.
Claude found computer parts nobody needed
📰 Full story: Claude looks for unused paths in software security
Anthropic shared a study about making software safer.
open-source
Software whose instructions people can see.
OpenSSH
Software that helps one computer connect to another.
Hacker News
A website where people discuss technology news.
Anthropic (the AI company that makes Claude) shared a study. Claude looked at 25 open-source software projects. Open-source means people can see the software’s instructions.
Software has many working parts. Some parts are not needed. Sometimes outsiders can still reach those parts. Claude looked for those extra paths.
It reported 493 things to check. These were not all things that could cause trouble right away. People must review each finding.
OpenSSH (software that connects computers) was one example. Claude found about 4,500 lines reachable too early. People checked the work. OpenSSH 10.6 included related fixes.
This is like closing a door nobody uses. It may make the software safer. It cannot fix everything.
The Hacker News post showed 94 points and 55 comments. Those numbers show attention. They do not prove the study. Anthropic wants to add this method to OSS-Scanner. People will need to test the results. Read the study and discussion.
💬 The story about Claude and safer code
People disagreed. Some saw a helpful tool, while others said it stopped safety work.
- Users say Claude sometimes stops safety checks and proof that a repair works. Another AI sometimes finished the job, but this was not a fair, same-condition test.
- Some people say this leaves protectors behind attackers. Others say safety rules can give important systems time to prepare before powerful AI spreads to public models, perhaps in about three months. That time is only one commenter’s estimate.
- People also argued about renting a cheap AI or running one themselves. The Vix author says Claude’s models split the project into smaller pieces over a weekend, but that is the author’s report.
- Another comment described 79 Mythos kernel problems that may not have been real or may already have been fixed. Careful human checking is still needed, and even math-based checks cannot always handle many connected parts.
initial digest at 55 comments (revision 1). We fetched 57 comments and sampled 57 across the thread. These are HN users’ reports, not independently verified facts.
💬 Claude and attack-surface reduction: a balanced Hacker News summary
The discussion split between people who see value in using AI to separate and audit code, and people who say safety controls also block defensive work. Most performance, failure, and outcome claims below are user reports, not independent measurements.
initial digest at 55 comments (revision 1). We fetched 57 comments and sampled 57 across the thread. These are HN users’ reports, not independently verified facts.