# Anthropic Frontier Red Team: 94 cases of open-source projects silently disabling security controls via configuration (attack surface reduction research)

> Anthropic's Frontier Red Team used Claude to examine 25 open-source projects and identified 493 attack-surface issues, including 94 cases where configuration settings silently disabled security controls. All 11 authentication-restricted projects contained code reachable without authentication; in OpenSSH roughly 4,500 lines of experimental ML-DSA-44 code were reachable by unauthenticated clients and were fixed in OpenSSH 10.5 and 10.6.

- **Published:** 2026-10-23T06:30:27Z
- **Last reviewed:** 2026-10-23T06:30:27Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4230
- **ID:** TL-2026-4230
- **Severity:** INFO
- **Category:** THREAT_INTEL
- **Status:** MONITORING
- **Detections:** 9 · **IOCs:** 6 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Anthropic's Frontier Red Team published research on attack surface reduction (Anthropic page dated 2026-10-20; Help Net Security coverage 2026-10-22). Claude analyzed 25 open-source projects (over 5 million lines of code in C, C++, Java, PHP and Python), inventorying more than 17,000 configuration options, of which 3,842 were judged security-relevant. The work found 493 issues across three techniques: default configuration (code reachable in shipped defaults but unused by intended functionality), configuration interaction (option pairs that look safe alone but interact badly), and early reachability (security-sensitive code that runs before authentication or a protocol transition).

Reported breakdown: 93 unnecessary pre-authentication surfaces in projects that gate access behind authentication (all 11 such projects had code reachable without authentication), 37 cases of code execution or state recording before authentication, 162 problematic configuration combinations, 94 cases where a setting silently disabled a security control, and 68 configuration inconsistencies. A recurring pattern appeared in four unrelated projects: hostname-based deny rules failed open when reverse DNS lookups were disabled. In another case a certificate-requirement setting could silently drop when combined with conflicting options; the behavior had existed for 21 years.

OpenSSH case study: roughly 4,500 lines of new, experimental ML-DSA-44 code (the post-quantum composite signature scheme ssh-mldsa44-ed25519, introduced as experimental and disabled by default in OpenSSH 10.4 on 2026-07-06) remained reachable by unauthenticated clients, about 16% of sshd's pre-authentication code in default builds. OpenSSH 10.5 (2026-08-11) repositioned the algorithm check, but gaps remained. OpenSSH 10.6 (2026-10-06) checks key and CA signature types against allowlists during key parsing as early as possible, removing about one-fifth of the previously reachable unauthenticated code in default builds.

This is defensive research. The sources name no CVEs, threat actors, in-the-wild exploitation or CVSS score. It is retained as configuration-hardening context: the findings show that defaults, option interactions and pre-authentication code paths expand exposure, and that audits of this kind (Claude, three sequential passes with empty context windows, validated against existing test suites) are being packaged into Anthropic's free opt-in OSS Scanner.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1021.004 SSH
- T1685 Disable or Modify Tools
- T1211 Exploitation for Stealth

## Sources

- [Anthropic finds 94 cases where open-source projects drop security controls without warning (Help Net Security)](https://www.helpnetsecurity.com/2026/10/22/anthropic-attack-surface-reduction-open-source/)
- [Anthropic Research: Attack surface reduction](https://www.anthropic.com/research/attack-surface-reduction)
- [OpenSSH Release Notes (10.4, 10.5, 10.6)](https://www.openssh.org/releasenotes.html)
- [OpenSSH 10.4 arrives with security fixes and a post-quantum signature option (Help Net Security)](https://www.helpnetsecurity.com/2026/07/06/openssh-10-4-released/)
- [OpenSSH 10.4 Patches Multiple Security Issues in SSH, SCP, and SFTP (Linuxiac)](https://linuxiac.com/openssh-10-4-patches-multiple-security-issues-in-ssh-scp-and-sftp/)
- [OpenSSH 10.4 Tightens Protocol Rules and Adds Post-Quantum Testbed (WebProNews)](https://www.webpronews.com/openssh-10-4-tightens-protocol-rules-and-adds-post-quantum-testbed/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4230