Using Claude to reduce the attack surface of code

What happened

Anthropic shared early research on "attack surface reduction." The attack surface is all the places where an attacker could try to get into a program. The team used Claude to map which code can be reached and then to remove or restrict access to code the software does not need to expose. Earlier, Anthropic had shown that frontier AI models (the most advanced AI systems) can find and exploit security holes. This research looks at how the same AI can help defenders.

Key numbers and facts

• Claude was run over 25 open-source projects.
• The projects together had more than five million lines of code.
• Languages included C, C++, Java, PHP, and Python.
• Claude found 493 issues.

Why code grows risky over time

Software often gets more complicated as years pass. New features, layers, and outside libraries (called dependencies) pile up. The code can then behave differently from what its builders planned. Attackers often study how code really works, not how it was meant to work. This is why hidden, unneeded features can become easy entry points.

Why it matters

Finding and fixing one bug at a time does not scale well, because fixing one bug says nothing about the others. Reducing what can be reached can lower the danger of unknown bugs, including ones attackers may already be using. The bugs still exist, but they are harder to reach. This can make software safer without finding each flaw first.

What to watch

• Whether developers start using AI tools to cut unneeded code paths in their own software.
• How the 493 issues found in the study are checked and fixed.
• Whether these methods work well on very large, real-world systems.