Over the past year, frontier AI models have shown they can discover and exploit security vulnerabilities. Chris Rohlf's team now explores how these models can strengthen cyber defense through automated attack surface analysis and reduction: using AI to map reachable code, then removing or restricting access to anything a deployment doesn't need to expose.
The approach matters because finding and fixing individual vulnerabilities scales poorly. Fixing one critical bug says nothing about the vulnerabilities that remain. By contrast, reducing code reachability lowers the severity of unknown vulnerabilities, including ones under active exploitation. The underlying flaws are not removed, but they become harder to reach. Minimizing a codebase's attack surface improves security without ever having to find or fix a specific vulnerability.
Software tends to grow more complicated over time as abstractions, dependencies and features accumulate, often making it behave differently than its developers intended. Attackers exploit this gap by studying how code actually behaves. Automated techniques aim to move unnecessary exposed code behind an appropriate gate, such as moving it from pre-authentication to post-authentication, from 0-click to 1-click, or from on-by-default to explicit opt-in.
The researchers focused on three methods: identifying code reachable in its default configuration that default functionality never needs, finding option pairs that cause issues when configured together, and locating complex, security-sensitive code that runs before authentication or a protocol state transition. Across 25 projects representing over five million lines of code, Claude discovered 493 issues. The results suggest developers can apply similar techniques to their own code to improve security economically.
Source: Hacker News · Summarized by HeadlinesBriefing