Anthropic Tests Using Claude to Shrink the Attack Surface of Software

Anthropic has previewed early research into using its Claude AI model for automated attack surface analysis and reduction. The process involves using AI to map the code that can actually be reached in a deployment, then removing or restricting access to anything that deployment does not need to expose. It builds on the company's earlier published data showing that frontier AI models can discover and exploit security vulnerabilities.

The argument is that fixing vulnerabilities one at a time scales poorly, because patching even a critical flaw says nothing about the flaws that remain. Reducing code reachability does not remove unknown vulnerabilities, but it makes them harder to reach and so lowers their severity. That includes flaws that may already be under active exploitation. Anthropic says this can improve security without ever having to find or fix an individual vulnerability.

To test the approach, Anthropic ran Claude over 25 open-source projects written in a variety of languages, and it discovered 493 issues. The company says the aim is to show Claude can improve software security meaningfully and economically. It also notes that software tends to grow more complicated over time, with extra layers, dependencies and features, so it can behave differently from what its developers intended. Attackers succeed in part because they study how code behaves in practice, not how it was designed to work.