TL;DR: Instead of hunting vulnerabilities one by one, shrink the code that can be reached. Claude analyzed 25 open-source projects, reported 493 issues, and cut about 16% of OpenSSH's pre-authentication code. Title: Using Claude to reduce the attack surface of code URL: Key points ・🗺️ 25 projects and 5M+ lines, with 17,000+ config options inventoried (3,842 security-relevant) ・🔓 93 unnecessary pre-auth surfaces in default configs, plus 61 combos that silently weaken a pre-auth control ・⚙️ 162 option combinations accepted with no warning, 94 of them silently disabling a security control ・🌐 Hostname-based rules relying on reverse DNS fail open when it's off (4 projects) ・⏳ A config conflict dropped a certificate requirement for 21 years, undocumented ・🔐 OpenSSH: about 4,500 lines of experimental ML-DSA-44 code reachable by unauthenticated clients removed, shipped in 10.6 Making unknown bugs unreachable seems more practical than fixing them one at a time. #AISecurity# #OpenSSH#

OpenShell v0.0.43 🛠️ bidirectional TTY streaming 🔒 OIDC auth in the TUI 🧩 HTTPS and mTLS decoupled 📦 TOML gateway config (RFC 0003) 🖥️ sandboxes boot from ext4 disks 🛡️ DNS removed from sandbox mapper to block exfiltration Authentication, streaming, and sandbox isolation improvements.

OpenShell v0.0.41 🧩 agent-driven policy management 🎚️ sandbox resource flags in the CLI 🔒 custom CA support for OIDC TLS verification 📥 sandbox downloads with workspace-boundary checks 🔧 bug fixes and stability improvements Policy and resource control, directly from the shell.

OpenShell v0.0.40 🔀 local-domain service routing in the gateway ☸️ k8s node scheduling + tolerations 🔒 CLI TLS now uses the OS trust store 🛡️ SecretResolver debug no longer leaks secrets Two security fixes ship alongside new routing and K8s scheduling control.

OpenShell v0.0.37 🧩 pluggable compute drivers: Docker, Podman, Kubernetes, MicroVM 🔒 OIDC + RBAC gateway auth ☸️ Helm chart + Kubernetes user namespaces 📦 Debian, RPM, and Homebrew packages breaking: recreate the gateway before upgrading.

NVIDIA 🔥: A new OpenShell Reference Architecture has been introduced along with a new NVIDIA DSX POD. AI factory deployment at a prepared site is now reduced from six months down to 14 days. This reduction saves tons of money for the industry.

NVIDIA introduces the OpenShell Reference Architecture to help businesses run AI agents under control. The open design combines accelerated compute for agents with hardware-isolated security for deployment at scale. Announced at GTC Berlin:

Azure Red Hat OpenShift with hosted control planes is now in public preview. Modernize applications faster, increase developer velocity, streamline operations, and strengthen security with a fully managed OpenShift experience. Learn more: