Software complexity often grows as developers add new features, dependencies, and layers of abstraction. This complexity can lead to 'unnecessary reachability,' where code exists in a codebase but is not intended to be accessible by a user in a standard deployment. Anthropic researchers argue that while finding and fixing individual vulnerabilities is a standard security practice, it scales poorly because it does not address the underlying risk of unknown vulnerabilities. Instead, they propose 'attack surface reduction,' which involves identifying and restricting access to code that does not need to be exposed, thereby reducing the severity of potential exploits even before a specific bug is discovered.
This image represents the research team's effort to identify and mitigate vulnerabilities in open-source projects.
To test this, Anthropic ran Claude over 25 open-source projects totaling over five million lines of code in languages such as C, C++, Java, PHP, and Python. The model identified 493 issues across three primary categories: default configurations that exposed unintended code, configuration interactions that silently disabled security controls, and 'early reachability' where sensitive code executed before authentication or protocol state transitions. For example, Claude identified 162 security-sensitive configuration combinations that were accepted without warnings; in 94 of those cases, the combination silently turned off a security control entirely. In another instance, Claude found a configuration flaw where a deny rule would 'fail open' because a server would compare a hostname pattern against a plain-text IP address when DNS lookups were disabled.
The research highlighted a significant real-world application in OpenSSH, a widely audited C codebase for secure remote access. Claude identified approximately 4,500 lines of experimental post-quantum signature algorithm code (ML-DSA-44) that were reachable by unauthenticated clients in the default configuration, even when the algorithm was explicitly excluded by an administrator. Anthropic reported these findings to the OpenSSH developers, leading to patches in the 10.5 and 10.6 releases. These updates moved the checks before the parsing stage, effectively removing roughly one-fifth of the code that an unauthenticated client could previously reach. The researchers note that if such vulnerabilities persist in highly audited code like OpenSSH, they are likely present in less scrutinized software, making automated attack surface reduction a high-leverage defense strategy.