The security researcher at Anthropic has freely released a playbook on how you can use AI to reduce the attack surface of your programs. Amid all the exploits we’re seeing right now, this is more important than ever. If you maintain a website, app, or online system, this is the part that’s most exposed—because an attacker can reach it without needing any password. Instead of hunting for vulnerabilities one by one, the goal is to expose less code to outsiders, making it harder even for undiscovered flaws to be reached. Anthropic tested this approach on OpenSSH—the program administrators use to access servers over the internet—and which they call one of the most thoroughly reviewed codebases in the world. According to their own analysis, their work reduced by about one-fifth the amount of code accessible to an unauthenticated user in the default installation. Anthropic had Claude search across three fronts and verify each finding, and they say the general approach works even without the specific tool they built. Here’s the step-by-step process: 1. Starting with the program in its default installation, identify code that external users can reach but that no legitimate function of the program ever uses. 2. Look for complex, sensitive code that runs before protections like login are enforced. 3. Test combinations of configuration options—two settings may seem harmless individually but, when combined, can silently disable a security measure. 4. Confirm each finding by running the actual program—not just by reading the code. 5. After each new restriction, run the project’s own test suite and ensure results remain unchanged. If a change affects a non-default configuration, require human approval. In Anthropic’s tests, Claude identified 493 issues across 25 open-source projects totaling over 5 million lines of code. In OpenSSH alone, they found roughly 4,500 lines of code in an experimental feature that any unauthenticated user could access by default. Anthropic notified the OpenSSH maintainers and collaborated with them to refine the fix. The first portion was released in version 10.5 in August, with the remainder included in version 10.6 on October 6. Start with your own program—in its default installation. If this was true for OpenSSH, imagine what’s lurking in code no one ever reviews.