Using Claude to reduce the attack surface of code

Claude identified a significant attack surface reduction opportunity in OpenSSH's 10.4 release. It found approximately 4,500 lines of new, experimental code for the ML-DSA-44 post-quantum signature algorithm that an unauthenticated client could reach, even when the algorithm was not enabled or explicitly excluded. This complex, memory-unsafe code, representing about 16% of OpenSSH's pre-authentication code, was reachable because the daemon parsed key types before checking if they were allowed. The issue was reported to OpenSSH developers, and the 10.5 release addressed it by moving the check before parsing.