Attack surface
Also called Attack Surface
Every point where an attacker could try to get in — the sum of all your exposed doors and windows.
Think of it like
A house’s attack surface is every door, window, and vent; the fewer and sturdier they are, the less there is to guard.
Example
Giving an AI agent web browsing, file access, and shell tools each widens its attack surface, since every tool is a new way things can go wrong.
How it actually works
The attack surface is all the inputs, interfaces, and permissions exposed to untrusted actors. Reducing it — fewer endpoints, tighter permissions, less parsing of untrusted data — is often cheaper and more reliable than defending a large one. For agentic AI, every added tool, integration, and data source expands it, which is why capability and risk grow together.
For product teams
Every feature and integration you add also adds a way in — surface grows with capability.
For engineers
The set of exposed inputs, interfaces, and permissions; minimizing it beats hardening a sprawling one.
Related
- Threat model — Mapped as part of the threat model.
- Air gap — Shrunk dramatically by an air gap.
- Principle of least privilege — Reduced by the principle of least privilege.
Read anything AI without the jargon
Look up any term in plain English, or save terms as you read with the free Chrome extension.
Open DecoderAdd to Chrome