[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"news-slug-anthropic-cyber-mission-oss-scanner":3,"topics-all":38,"news-related-6e2537e2-8be4-4d2f-860c-127a22c60e12":57},{"id":4,"title":5,"summary":6,"content":7,"original_url":8,"source_id":9,"tags":10,"translations":24,"news_slug":31,"published_at":32,"created_at":33,"modified_at":34,"is_published":35,"publish_type":36,"image_url":14,"view_count":37},"6e2537e2-8be4-4d2f-860c-127a22c60e12","Anthropic 把 Claude 拉进基建与开源安全","Anthropic 10 月 8 日启动 Cyber Mission:Claude 进 OT 防御链,联合 Accenture、CrowdStrike、Dragos 等 11 家;OSS Scanner 对标 OSS-Fuzz 免费给开源项目跑漏洞扫描,目标真阳性率 90%。","AI 攻防的不对称在 2026 年越拉越开:攻击方拿模型找漏洞便宜又高效,防守方还在靠人。Anthropic 10 月 8 日正式把这一短板摆上桌面,推出 Anthropic Cyber Mission,把自家最强 Claude 拉进两条防线:关键基础设施的现场工程,和支撑全球软件供应链的开源代码。\n\n## 关键基础设施:把模型和工程师一起送进场\n\nAnthropic 同日宣布的 Critical Infrastructure Defense Program,核心思路是「不打头阵,做外援」。电网、供水、工厂、轨道交通跑的 Operational Technology 设备按二十年寿命设计,带病上线是常态,已知漏洞往往一挂就是几年。Anthropic 不直接下场修设备,而是把 frontier Claude 模型、驻场工程师、威胁研究一并给到 11 家创始伙伴,让他们各自去服务自己的客户。\n\n创始伙伴名单按角色分了三组:咨询与系统集成 Accenture、Booz Allen、Deloitte、PwC;安全厂商 CrowdStrike、Palo Alto Networks、Dragos、Nozomi Networks、Insane Cyber;设备厂商 Hitachi、Rockwell Automation。这套组合基本把工业控制系统防御链上的咨询、检测、修补三段全覆盖。Booz Allen 商业网络总裁 Andrew Turner 把 OT 称作「autonomous AI-enabled attacks 的下一个前沿」,潜台词是攻击侧已经在做 AI 自动化,防守侧的工具栈必须同步升级。Anthropic 在公告里也明确表态,首阶段只挑小范围合作,目的是跑出哪类打法最有效,再扩面。\n\n## 开源软件:把未审报告直接放给维护者\n\nCyber Mission 的第二条腿 OSS Scanner 更加轻量,逻辑也直接。Project Glasswing 期间,Anthropic 在广泛使用的开源项目里挖出过 2.9 万余条候选漏洞,人工审过 6000 多份,剩下没审的本来要排队。Anthropic 发现,有相当一批维护者能力足够,直接要未审的全量报告自己消化,索性把它做成常驻服务。\n\nOSS Scanner 设计对标 Google 的 OSS-Fuzz:维护者提交 PR 把项目加进 anthropics\u002Foss-scanner 仓库,提供 Dockerfile 让模型在断网容器里跑审计,报告里附 PoC、根因、建议补丁,严重度可由项目方自定义。Anthropic 同步提供威胁模型文件配置,允许维护者告诉模型「这块是攻击面、那块可以忽略」。报告不再走人工复核,换来的是更短的发现-通报周期,Anthropic 给出的目标是真阳性率维持在 90% 以上。\n\n在内部 dry-run 中,Anthropic 让资深渗透测试员审了 48 个项目里早期版本产出的 97 条 critical\u002Fhigh 报告,85 条直接通过披露;另外 12 条里 11 条是真实漏洞、只是和已知或本次扫描内其他条目重复。wolfSSL 在早期试用阶段收到 74 份报告,72 份可用,其中 5 份直接生成 CVE。维护者 Anton Arapov 的评价直白:带可复现利用代码的报告,基本上等于修完了。\n\n## 不替代,而是叠加\n\nAnthropic 在公告里划了一条清晰的边界:OSS Scanner 服务的是「能消化未审报告」的成熟项目;容量不够的小项目,继续走原有的人工协调披露流程。两个项目背后都是 Project Glasswing 的延伸,Glasswing 本周已经并入扩容后的 Cyber Verification Program,Anthropic 的资源正在向「防御侧」集中。\n\nAnthropic 同时给维护者开了 Claude for Open Source 申请通道,送 Claude Max 20x 订阅;Defender Advantage Fund(0xDAF)负责给 OSS Scanner 长期兜底,这笔基金 8 月成立时已经承诺给 Python Software Foundation、Apache Software Foundation、Linux Foundation 旗下的 Alpha-Omega 与 OpenSSF 持续投钱。AI 防守战的硬件、模型、人力,Anthropic 试图一次性都补上。\n\n## 防守侧还在「慢」的那两年\n\nAnthropic 自家的预测并不乐观:接下来两年,漏洞利用成本还会继续下降,验证、披露和修复依然吃人力;OT 场景下,一个补丁可能要等设备能安全停机时才能上,极端情况要等几十年。Cyber Mission 现阶段的目标是让水、电、通讯、交通在对手用 AI 攻击时还能正常运转、可被利用路径更少、出了事恢复更快。这不是一次性动作,而是 Anthropic 自己承认要持续多年的长期工程。","https:\u002F\u002Fwww.anthropic.com\u002Fnews\u002Fanthropic-cyber-mission","1fa87d30-d9f3-4752-b3be-0373933b3aaf",[11,15,18,21],{"id":12,"name":13,"slug":13,"description":14,"color":14},"1fcfaaf2-67de-43d3-9e35-5784852fec60","ai-safety",null,{"id":16,"name":17,"slug":17,"description":14,"color":14},"23544f6a-eea1-4f05-aa8d-749ca862d5d2","anthropic",{"id":19,"name":20,"slug":20,"description":14,"color":14},"01598627-1ea6-4b27-a5d8-874971571a71","llm",{"id":22,"name":23,"slug":23,"description":14,"color":14},"02bfdc0f-5e23-4fbb-b31a-7cc03cdba1ee","security",[25],{"id":26,"lang":27,"title":28,"summary":29,"content":30},"41025927-679b-4e84-81de-0e4e7004222f","en","Anthropic's Cyber Mission Puts Claude in OT and OSS Defense","Anthropic's Cyber Mission: Claude in OT defense (11 partners) and OSS Scanner, free open-source scans via Claude, 90% true-positive target.","The asymmetry between AI-driven attackers and defenders keeps widening in 2026: finding vulnerabilities with a model is now cheap and fast, while verification and remediation still run on human labor. Anthropic put that gap on the table on October 8 with Anthropic Cyber Mission, putting its strongest Claude to work on two fronts: on-site engineering for critical infrastructure, and the open-source code that underpins the global software supply chain.\n\n## Critical infrastructure: shipping models and engineers together\n\nThe Critical Infrastructure Defense Program, announced the same day, follows a clear principle: Anthropic doesn't enter the field; it acts as a force multiplier. Operational Technology equipment that runs power grids, water utilities, factories, and rail networks is designed to last twenty-plus years; shipping with known flaws is normal, and a vulnerable control system can sit unpatched for years. Anthropic is not patching the equipment itself. Instead, it hands frontier Claude models, on-site engineers, and threat research to eleven founding partners, who then serve their own customers.\n\nThe eleven partners fall into three groups. Consulting and system integration: Accenture, Booz Allen, Deloitte, PwC. Security vendors: CrowdStrike, Palo Alto Networks, Dragos, Nozomi Networks, Insane Cyber. Equipment vendors: Hitachi, Rockwell Automation. Together, they cover consulting, detection, and remediation across the industrial control system defense chain. Andrew Turner, president of commercial cyber at Booz Allen, called OT the next frontier for autonomous AI-enabled attacks, hinting that attackers are already automating with AI and defenders' tooling has to keep up. Anthropic stated openly in the announcement that the first phase is a small cohort, designed to learn which approaches actually work before scaling.\n\n## Open source: handing unreviewed reports straight to maintainers\n\nThe second leg of Cyber Mission, OSS Scanner, is more lightweight and direct. During Project Glasswing, Anthropic's models surfaced over 29,000 candidate vulnerabilities across widely used open-source projects; staff manually reviewed just over 6,000. A growing share of maintainers had the capacity to triage at scale and asked for the full unreviewed set, so Anthropic turned that ad-hoc arrangement into a standing service.\n\nOSS Scanner mirrors Google OSS-Fuzz. Maintainers enroll by opening a PR in the anthropics\u002Foss-scanner repo, supply a Dockerfile so the model can run audits in an offline container, and receive reports that include a proof of concept, root cause analysis, and suggested patches. Severity can be customized per project. Anthropic also offers a threat model configuration file that lets maintainers tell the scanner which inputs are adversarial and which areas are out of scope. Reports skip human review in exchange for shorter find-to-notify cycles; Anthropic targets a true-positive rate above 90%.\n\nIn an internal dry run, senior penetration testers vetted 97 critical and high-severity findings from an early-version scanner across 48 projects and cleared 85 for disclosure. Of the remaining 12, eleven were real bugs that duplicated known issues or other findings from the same scan. During early trials, embedded crypto library developer wolfSSL received 74 reports, found 72 valid, and turned five into CVEs. Maintainer Anton Arapov's verdict was blunt: a report with a working exploit attached is essentially the fix.\n\n## Not a replacement, but a layer\n\nAnthropic drew a clear boundary in the announcement: OSS Scanner is for projects with the capacity to absorb unreviewed findings; projects without that bandwidth continue to receive human-verified disclosures through the existing coordinated disclosure process. Both efforts extend Project Glasswing, which was folded into an expanded Cyber Verification Program earlier this week, with Anthropic's resources tilting toward the defensive side.\n\nAnthropic also opened the Claude for Open Source application channel, providing free Claude Max 20x subscriptions, and the Defender Advantage Fund (0xDAF) keeps OSS Scanner free long-term. The fund, established in August, has already committed ongoing support to the Python Software Foundation, the Apache Software Foundation, and Alpha-Omega and OpenSSF via the Linux Foundation. Anthropic is trying to backstop hardware, models, and human capacity in the AI defense war in one go.\n\n## Defenders are still in the slow lane, for now\n\nAnthropic's own forecast isn't optimistic. Over the next two years, the cost of exploiting a vulnerability will keep falling, while verification, disclosure, and repair remain human-bound. In OT settings, a patch may have to wait for a safe maintenance window, and in extreme cases, that could mean decades. The current objective of Cyber Mission is to keep water, power, communications, and transport running in the face of AI-enabled attacks, with fewer exploitable paths and faster recovery when something gets through. This isn't a one-shot effort; Anthropic itself acknowledges it as a multi-year long-term engineering program.","anthropic-cyber-mission-oss-scanner","2026-10-08T09:00:00Z","2026-10-09T01:10:03.076751Z","2026-10-09T01:10:03.076760Z",true,"agent",226,[39,48],{"slug":40,"tag_slug":40,"title_zh":41,"title_en":42,"intro_zh":43,"intro_en":44,"id":45,"is_active":35,"created_at":46,"modified_at":47},"ai-for-science","AI for Science 2026：从 UniPert 到 GPT-Rosalind 的硬核进化","AI for Science 2026: from UniPert to GPT-Rosalind","生命科学、化学材料、物理世界模型——AI 正在从\"语言工具\"变成\"实验伙伴\"。本专题收录 AI 在三大科学方向的关键节点：UniPert 统一基因与化学扰动空间、GPT-Rosalind 端到端生命科学推理、达摩院 AI 智能体 28 小时找到 4 种超导新材料、Anthropic Claude Science 把工作台做成标准品。","From language tool to lab partner — AI is reshaping life sciences, chemistry\u002Fmaterials, and physical world models. This topic covers the key milestones: UniPert unifying genetic-chemical perturbation spaces, GPT-Rosalind's end-to-end life-sciences reasoning, DAMO's AI agent discovering 4 superconducting materials in 28 hours, and Anthropic's Claude Science workbench going mainstream.","988a4300-5fab-41c4-b5d8-63711a2dc757","2026-09-10T01:34:15.296649Z","2026-09-10T01:34:15.296663Z",{"slug":49,"tag_slug":49,"title_zh":50,"title_en":51,"intro_zh":52,"intro_en":53,"id":54,"is_active":35,"created_at":55,"modified_at":56},"h3-series","MiniMax H3 系列：从开源权重到 35 倍吞吐","MiniMax H3 Series: from open weights to 35x throughput","MiniMax H3 自 2026 年 8 月开源以来节奏密集：官方把生成、参考与编辑收回一个模型；ComfyUI 当天压进 RTX 3060；摩尔线程 3 小时完成国产 GPU 适配；fal 后训练版把吞吐拉到 35 倍；FastH3 蒸馏再砍推理成本。本专题持续追踪 H3 的发布—开源—蒸馏—部署全链路。","Since MiniMax open-sourced H3 in August 2026 the pace has been relentless: one unified omni-modal model, same-day ComfyUI support down to an RTX 3060, a 3-hour Day-0 port to Moore Threads GPUs, fal's post-trained H3 Max at 35x throughput, and FastH3 distillation cutting inference cost further. This topic tracks the full H3 chain — release, open weights, distillation, deployment.","83ef0daa-3c31-4cb3-86ed-e5ee58654d5f","2026-09-08T07:33:19.942193Z","2026-09-08T07:33:19.942209Z",{"items":58},[59,64,69,74,79,84],{"id":60,"title":61,"news_slug":62,"published_at":63},"5796d012-e921-4760-b58f-653b90c151b1","Claude 削攻击面:25 个开源项目 493 处问题","claude-attack-surface-reduction-openssh","2026-10-22T05:20:00+00:00",{"id":65,"title":66,"news_slug":67,"published_at":68},"c2c96e3a-cc8d-4970-8d9d-e9584bbc9237","WhatsApp 帮助页藏 102 块 LLM 暗指令","whatsapp-hidden-llm-instructions-help-pages","2026-10-19T16:00:00+00:00",{"id":70,"title":71,"news_slug":72,"published_at":73},"2c1d70a6-02aa-4b17-9413-a8663216baf6","Anthropic 网络验证改三层:Glasswing 并入","anthropic-glasswing-cyber-verification-tiers","2026-10-15T09:10:00+00:00",{"id":75,"title":76,"news_slug":77,"published_at":78},"acddc7d5-c389-4e90-8a7a-1001ce693395","Anthropic 反蒸馏到第三层:误拦也要收费,合法用户背成本","anthropic-distillation-shields-claude-paywall-blocks","2026-10-14T03:00:00+00:00",{"id":80,"title":81,"news_slug":82,"published_at":83},"e67e70ff-6e41-48fb-a22d-9249eca411ae","AI 炒作叙事不需要全部买账","ai-hype-mythos-counter","2026-10-05T05:00:00+00:00",{"id":85,"title":86,"news_slug":87,"published_at":88},"e0642de2-5fec-472b-b85e-c63ccbad3b75","Anthropic 研究员公开辞职:AI 巨头正「拿全人类的命豪赌」自我进化超级智能","anthropic-coxon-resigns-ai-extinction-fears","2026-09-24T06:30:00+00:00"]