TL;DR: Instead of hunting vulnerabilities one by one, shrink the code that can be reached. Claude analyzed 25 open-source projects, reported 493 issues, and cut about 16% of OpenSSH's pre-authentication code. Title: Using Claude to reduce the attack surface of code URL: Key points ・🗺️ 25 projects and 5M+ lines, with 17,000+ config options inventoried (3,842 security-relevant) ・🔓 93 unnecessary pre-auth surfaces in default configs, plus 61 combos that silently weaken a pre-auth control ・⚙️ 162 option combinations accepted with no warning, 94 of them silently disabling a security control ・🌐 Hostname-based rules relying on reverse DNS fail open when it's off (4 projects) ・⏳ A config conflict dropped a certificate requirement for 21 years, undocumented ・🔐 OpenSSH: about 4,500 lines of experimental ML-DSA-44 code reachable by unauthenticated clients removed, shipped in 10.6 Making unknown bugs unreachable seems more practical than fixing them one at a time. #AISecurity# #OpenSSH#