Using Claude to reduce the attack surface of code

Commenters debated an Anthropic post about using Claude to reduce code attack surface, with many focusing less on the proposal and more on product behavior and engineering choices. Several complained that Claude drops to less capable models or blocks outputs when given cybersecurity tasks, forcing engineers to work around "nannying" and restart sessions; one suggested a move to a mix of Codex and open models. Others raised higher-level visions: one commenter advocated for full formal verification languages, uni-kernels, tiny TCBs and even verified hardware as the long-term path. Small observations - typos in the post and the irony of using Next.js/React for a security-minded chat app - were also raised.

Opinion split sharply on tooling and openness. Some defended React as a compact, battle-tested reactive UI, while others pointed to large internal files and the broader JS runtime as meaningful attack surface. On models, some argued for open/self-hosted models to enable verification and avoid restrictive behavior; others warned about security implications, geopolitical risks, and the practical value of subsidized proprietary enterprise plans, suggesting a middle ground (Fireworks, OpenRouter providers). Frustration was common: several commenters said having to “play theater” to get fixes from the model undermines confidence in its usefulness.