Bright key facts / Emerging
The safer question AI asked of OpenSSH: Why can strangers reach this code?
Claude-assisted research led to a real OpenSSH change: check whether a key type is allowed before doing more work on it. The bigger lesson is about reducing the routes attackers can take, while letting maintainers judge the evidence.
- AI’s role
- Claude-assisted analysis identified unnecessarily reachable code and helped support earlier allowlist checks, subject to maintainer triage, testing and repair decisions.
- Documented result
- OpenSSH 10.6 release notes confirm early checks of key and certificate-authority signature types, shipped October 6. Anthropic’s October 20 research describes this earlier repair. Its 493 survey issues and roughly one-fifth reachability estimate are company-reported, not independently established vulnerabilities or risk reductions.
- Important limitation
- 493 issues across 25 projects are not 493 exploitable vulnerabilities or accepted fixes.