Anthropic finds 94 cases of silently disabled security controls in open source

Anthropic's Frontier Red Team used Claude to audit 25 open-source projects and reported 493 issues involving unnecessary exposure, conflicting settings and code running before security checks. In 94 cases, configuration combinations silently disabled security controls, and OpenSSH exposed about 4,500 lines of post-quantum code before authentication.

• 25 projects audited, 493 issues of unnecessary code exposure found
• 162 setting combinations accepted without warnings, 94 silently disabled security controls
• OpenSSH exposed ~4,500 lines of ML-DSA-44 code before authentication
• OpenSSH 10.6 patches cut pre-auth reachable code by about a fifth