Using Claude to reduce the attack surface of code (www.anthropic.com)

Recent research by Chris Rohlf highlights the use of Claude, a frontier AI model, in enhancing cybersecurity through automated attack surface analysis and reduction. This approach aims to map the accessible code in software applications and systematically remove or limit access to code that isn't necessary for deployment. The significance of this research lies in its potential to substantially improve software security, as reducing an application's attack surface can lower the severity of unknown vulnerabilities and make them harder for attackers to exploit, rather than just addressing known issues. In a study involving 25 open-source projects across multiple programming languages, Claude identified 493 security-related issues. The model's analysis revealed critical insights, such as unnecessary pre-authentication code exposure and conflicting configuration options that could weaken security controls. For instance, in the OpenSSH project, Claude uncovered that approximately 4,500 lines of experimental code were unnecessarily reachable by unauthenticated clients. These findings provide developers actionable steps to enhance security practices, emphasizing how AI can be leveraged to not only identify vulnerabilities but also streamline defenses in complex software environments.