Use Claude to map and shrink the attack surface of a codebase
Anthropic's Frontier Red Team had Claude map which code in a deployment is actually reachable, build an inventory of configuration options, then remove or restrict whatever a given deployment does not need to expose, instead of hunting bugs one at a time.
Source
dnw on Hacker News · 2026-10-21 · Project link
Written in our own words. Credit to the original author. Link checked 2026-10-21.
What they did
Anthropic's Frontier Red Team had Claude map which code in a deployment is actually reachable, build an inventory of configuration options, then remove or restrict whatever a given deployment does not need to expose, instead of hunting bugs one at a time.
Result (as claimed)
Run over 25 open-source projects in C, C++, Java, PHP and Python, Claude catalogued over 17,000 configuration options and found 493 issues.
Tools they used
Cost: Pricing depends on the tools you pick; check each official pricing page.
Set it up
Pick a contained repo or task
Start on a branch or side project where mistakes are cheap.
Install and configure
Set up Claude. Read what it can run on your machine and limit permissions where possible.
Run it on a real task
Give it a well-scoped issue and let it work. Review the diff like any pull request.
Add guardrails
Keep tests and CI in the loop, and never let an agent push to main or touch production secrets unattended.
Copy the full setup prompt
Paste into your agent and it will walk you through the setup, asking before anything that sends, posts or spends.
You are helping me set up this AI use case end to end in Claude Code. Goal: Use Claude to map and shrink the attack surface of a codebase What the original author did: Anthropic's Frontier Red Team had Claude map which code in a deployment is actually reachable, build an inventory of configuration options, then remove or restrict whatever a given deployment does not need to expose, instead of hunting bugs one at a time. Reported result (as claimed by the author): Run over 25 open-source projects in C, C++, Java, PHP and Python, Claude catalogued over 17,000 configuration options and found 493 issues. Source: https://news.ycombinator.com/item?id=50175779 Tools they used: Claude Category: Dev & ops Please: 1. Ask me 3 short questions about my situation (accounts I have, budget, what I want the output to look like). 2. Propose a step-by-step plan using these tools or cheaper alternatives, with the time and cost of each step. Use official pricing pages; say "check pricing" if unsure. 3. Then do the setup with me one step at a time, waiting for my OK before anything that sends messages, posts publicly, spends money or deletes data. 4. Finish with a checklist to run it again next time.
You are helping me set up this AI use case end to end in Codex. Goal: Use Claude to map and shrink the attack surface of a codebase What the original author did: Anthropic's Frontier Red Team had Claude map which code in a deployment is actually reachable, build an inventory of configuration options, then remove or restrict whatever a given deployment does not need to expose, instead of hunting bugs one at a time. Reported result (as claimed by the author): Run over 25 open-source projects in C, C++, Java, PHP and Python, Claude catalogued over 17,000 configuration options and found 493 issues. Source: https://news.ycombinator.com/item?id=50175779 Tools they used: Claude Category: Dev & ops Please: 1. Ask me 3 short questions about my situation (accounts I have, budget, what I want the output to look like). 2. Propose a step-by-step plan using these tools or cheaper alternatives, with the time and cost of each step. Use official pricing pages; say "check pricing" if unsure. 3. Then do the setup with me one step at a time, waiting for my OK before anything that sends messages, posts publicly, spends money or deletes data. 4. Finish with a checklist to run it again next time.
You are helping me set up this AI use case end to end in Grok Bot. Goal: Use Claude to map and shrink the attack surface of a codebase What the original author did: Anthropic's Frontier Red Team had Claude map which code in a deployment is actually reachable, build an inventory of configuration options, then remove or restrict whatever a given deployment does not need to expose, instead of hunting bugs one at a time. Reported result (as claimed by the author): Run over 25 open-source projects in C, C++, Java, PHP and Python, Claude catalogued over 17,000 configuration options and found 493 issues. Source: https://news.ycombinator.com/item?id=50175779 Tools they used: Claude Category: Dev & ops Please: 1. Ask me 3 short questions about my situation (accounts I have, budget, what I want the output to look like). 2. Propose a step-by-step plan using these tools or cheaper alternatives, with the time and cost of each step. Use official pricing pages; say "check pricing" if unsure. 3. Then do the setup with me one step at a time, waiting for my OK before anything that sends messages, posts publicly, spends money or deletes data. 4. Finish with a checklist to run it again next time.
The Daily 5
Get five new use cases tomorrow morning
Free. Real sources. Unsubscribe any time.
Related use cases
Build a Redis-compatible database in Rust with Claude as your pair
A developer started KiviDB in February to learn Rust after hitting GC pauses and out-of-memory crashes with Dragonfly at work. He used AI a lot but made the design decisions himself, based on tests Claude picked from his history of troubleshooting sessions. It speaks RESP2 and RESP3, shards the keyspace across threads and uses io_uring on Linux.
Give each part of your system its own Claude "superfan" that watches its health
An engineer wrote up agentic monitoring after Anthropic described Slack channels where a Claude is assigned to obsess over a single component, with access to its telemetry and logs. He argues these agents catch subtle, novel issues that fixed alerts miss.
See whether a Claude Code skill really changes the output before you install it
Use This Skill runs each agent skill through Claude twice on the same brief, once with it and once without, and shows both pages side by side. The builder made it because there are thousands of skills and no easy way to tell which ones help.
Manage your domain's DNS records from Claude or Codex
Tired of clicking through the LWS panel, the author built lws-mcp, an open-source MCP server so you can say "Add Stripe's DNS records" in Claude, Codex or Cursor and have it done and verified.