Using Claude to reduce the attack surface of code

This report describes research using the Claude model to automatically map and reduce software attack surface across 25 open-source projects (5M+ LOC), identifying 493 issues including pre-auth reachable code, insecure configuration interactions, and default-exposed functionality; a notable case in OpenSSH found ~4,500 lines of experimental signature parsing reachable pre-auth, which was reported and fixed. The authors present methods (default-configuration analysis, configuration-interaction checks, and early-reachability detection), demonstrate practical fixes and a Claude skill to automate three analysis passes, and argue that reducing reachability materially lowers risk from unknown vulnerabilities even when individual bugs remain unfixed.