---
title: 'In the News: October 21, 2026 (Extra)'
description: "Anthropic's Frontier Red Team reports 493 attack-surface issues across 25 open-source projects, including 4,500 lines of unconfigured code reachable in OpenSSH."
canonical_url: 'https://darkfactory.dev/news/2026-10-21-extra'
markdown_url: 'https://darkfactory.dev/news/2026-10-21-extra.md'
collection: news
date_published: '2026-10-21T10:35:00-04:00'
date_modified: '2026-10-21T10:35:00-04:00'
---

# In the News: October 21, 2026 (Extra)


Anthropic published a method for having an agent find code that attackers can reach but the deployment never needed, with a verification loop built in. A vendor study of Qwen3-Coder adds a data point on why a clean scanner run is weak evidence about generated code. Two items this cycle.

## 1. Anthropic's red team has Claude shrink attack surface instead of hunting individual bugs, and reports 493 issues across 25 projects

**[Using Claude to reduce the attack surface of code](https://www.anthropic.com/research/attack-surface-reduction)** · Chris Rohlf · Anthropic Frontier Red Team, October 20, 2026

Anthropic ran Claude over 25 open-source projects, more than five million lines in C, C++, Java, PHP and Python, and reports 493 issues. Claude inventoried over 17,000 configuration options, 3,842 of them security relevant. It found 162 security-sensitive option combinations that were accepted with no warning and no documentation of their interaction; in 94 of them the combination silently turned off a security control. In the 11 "gated" projects, which are meant to serve only authenticated users, it reports 93 unnecessary pre-authentication surfaces. The post says none of these would have been immediately exploitable on its own.

The OpenSSH case is the concrete one. In the 10.4 release, Claude traced about 4,500 lines of experimental ML-DSA-44 code that an unauthenticated client could reach in the default configuration, roughly 16% of sshd's pre-authentication code, even when an administrator had excluded the algorithm. Anthropic sent patches; version 10.5 moved the check earlier, Claude then found two gaps in that check, and the maintainers shipped a further fix in 10.6.

Anthropic packaged the method as a Claude skill that runs three passes, each starting with an empty context window plus a short note from the prior pass. Every finding is confirmed with a dynamic trace. A proposed gate must leave default behavior unchanged, checked by running the project's own test suite and a black-box regression suite against the baseline, and any gate that would change a non-default configuration is set aside for a human to decide. The post gives counts of issues Claude reported, not how many maintainers confirmed outside the OpenSSH work, and the study comes from the lab that makes the model.

**Why it matters:** For anyone building an agent that edits code it did not write, the workflow is the reusable part: fresh-context passes, a runtime check on every claim, a hard "behavior must not change" test gate, and a named class of change reserved for a human. That is a verification loop you can copy before you copy the security topic.

## 2. A security vendor says Qwen3-Coder writes more hackable apps depending on who the customer is, and that a security instruction did not close the gap

**[Chinese AI Writes Weaker Code for Beijing's Adversaries. We Fixed It. A Qwen3-Coder Case Study](https://www.hirundo.io/blog/qwen3-coder-vulnerabilities)** · Ben Luria · Hirundo, October 21, 2026

Hirundo had Qwen3-Coder-30B-A3B-Instruct build the same BaxBench "SecretStorage" web app, changing only the customer named in the system prompt, with 190 apps per customer. It reports that 70% of apps for a US defense contractor could be broken into by BaxBench's exploits, against 59% for a Chinese defense contractor (p = 0.03). Adding BaxBench's instruction to "Make sure to follow best practices for security and avoid common vulnerabilities" left the US contractor at 74% hackable against 59% for a neutral customer.

The authors also report that Semgrep with Meta's PurpleLlama rules flagged 2 of the 1,840 apps, while BaxBench's attacks broke into 1,144. The claim that the behavior lives in the model's weights rests on Hirundo's own edited version of the model, which closed the gaps and which the company sells as a service. It is one model on one task, the study has not been independently replicated, and Hirundo has published its edited weights on Hugging Face.

**Why it matters:** Even if the persona effect does not hold up, the scanner figure is a reason not to treat a static-analysis pass as the verification step for generated authentication code. Run the exploits against the running app, and test under the customer names you actually ship for.