Introducing the Anthropic Cyber Mission
https://www.anthropic.com/news/anthropic-cyber-mission📌 【Anthropic 官方發布】Cyber Mission 啟動:電網、水務與開源程式碼成防守重點
TL;DR:Anthropic 成立長期網路安全計畫 Cyber Mission,首波聚焦關鍵基礎設施防禦與開源弱點掃描。
國家級攻擊者已經在電網、水務與交通系統裡潛伏多年,等待時機發動破壞;而站在第一線防守的團隊,長期面臨資源嚴重不足的困境。Anthropic 這次選擇直接下場,把 frontier 模型送進防守方手中。
🤔 Project Glasswing 的教訓:找到漏洞容易,降低風險卻很難
Anthropic 指出,frontier 模型固然可能被濫用於攻擊與網路行動,但現實是許多關鍵技術領域仍然嚴重暴露。在 Project Glasswing 專案中,合作夥伴找出了大量漏洞,但 Anthropic 坦言「尚未達到足夠的網路風險降低」,原因在於驗證、排序與修補這些發現仍然困難。基於這個教訓,Project Glasswing 已在本週併入擴大版的 Cyber Verification Program,而 Cyber Mission 則是下一步的長期投資。
🧩 兩條起步戰線:關鍵基礎設施與開源軟體
第一條戰線是關鍵基礎設施,從保護電網、水務系統、交通網路背後的「操作技術」(OT)以及政府系統開始。Anthropic 今天推出 Critical Infrastructure Defense Program(CIDP),把 frontier Claude 模型、駐點工程師與威脅研究帶給保護 OT 的供應商,創始夥伴包括 Accenture、Booz Allen、CrowdStrike、Deloitte、Dragos、Hitachi、Insane Cyber、Nozomi Networks、Palo Alto Networks、PwC 與 Rockwell Automation。第二條戰線是開源軟體,也就是同日上線的 OSS Scanner,為開源專案提供免費的定期安全掃描。
💡 為什麼 OT 系統特別難防:不能說關就關
電網、水廠、工廠與交通網路運行在設計使用數十年的控制器與工業網路上,這些系統往往無法離線修補,已知漏洞可能因此存留多年。素材中的夥伴描述這個痛點最具體:像是偏遠變電站、海上平臺或實體隔離的工廠,正是傳統工具搆不到、專家也無法常駐的地方。CrowdStrike 提到,威脅行為者已經用 AI 以機器速度尋找並利用暴露點,CIDP 的價值在於把威脅情報與 frontier 模型結合,讓防守方也能用機器速度應對。PwC 則強調,他們在 OT 環境中親眼見過網路攻擊造成的嚴重後果,認為需要跨產業協調一致的努力才能真正降低風險。
⚠️ 目前仍是小規模試驗階段
Anthropic 表示第一步只會與一小群供應商合作,學習哪些策略最有效、最實際,並強調 AI 必須被謹慎應用、嚴格驗證,且以安全與可靠性為前提才能真正強化關鍵基礎設施的韌性。
🎯 實務啟示
若所屬公司從事關鍵基礎設施的安全產品或服務,可向 Anthropic 登記加入 CIDP 的意願;開源專案維護者則可參考 OSS Scanner 的申請流程,取得免費的定期資安掃描。
🔗 來源
- 標題:Introducing the Anthropic Cyber Mission
- 作者/機構:Anthropic
- 連結:https://www.anthropic.com/news/anthropic-cyber-mission
#Anthropic #CyberMission #CriticalInfrastructure #OSSScanner #OTSecurity #Cybersecurity #CrowdStrike #ProjectGlasswing #AISecurity #ClaudeAI
原始資料 Anthropic News · 收集於 2026-10-08
摘要原文
Announcements Introducing the Anthropic Cyber Mission Oct 8, 2026 Today we’re launching the Anthropic Cyber Mission, a long-term commitment to securing the systems everyone depends on. The Cyber Mission is a new effort to support defenders with tools, research, and resources to secure their software and systems. We’re starting with two areas: Critical infrastructure: Starting with securing the operational technology behind power grids, water systems, and transportation networks, and protecting government systems. Today, we’re introducing the Critical Infrastructure Defense Program (CIDP), which brings frontier models, on-site engineers, and threat research to the defenders that protect operational technology. Open-source software: Finding vulnerabilities and proposing patches in the free, shared code that most software depends on, and hardening the underlying code. Today, we’re launching OSS Scanner , which offers open-source projects regular security scans from our strongest models, for free. Frontier models can be misused to exploit vulnerabilities and conduct cyber operations. Despite best efforts, many areas of technology remain dangerously exposed. State-sponsored adversaries have spent years gaining footholds in these systems, across many sectors, so that they can disrupt them. Defenders of critical infrastructure and the OSS community have decades of security experience but have faced severe resource shortages that are exacerbated by this moment. We are recognizing their expertise in these domains and offering our support. We will also expand the Cyber Mission to release tools, research, and resources in new areas to help secure the world. As part of Project Glasswing , partners uncovered many vulnerabilities, but we haven’t yet achieved a sufficient reduction in cyber risk. It’s easier than ever to find vulnerabilities, but verifying, prioritizing, and fixing these findings remains challenging. Based on lessons from Project Glasswing, we’re starting these new efforts to support defenders. Earlier this week, we merged Project Glasswing into our expanded Cyber Verification Program , which gives many more defenders access to our most capable models. And through the Anthropic Cyber Mission, we’ll deploy Anthropic engineering talent and provide tools and funding for those who secure critical infrastructure and open-source software. Defending critical infrastructure Power grids, water utilities, factories, and transportation networks run on controllers, control software, and industrial networks built to last for decades. These systems are known as “operational technology,” and they often cannot be taken offline to patch, so known vulnerabilities can stay unresolved for years. Securing them is specialized work: the equipment is proprietary, changes are risky, and a mistake can take down a plant. Operators of every size rely on a small set of trusted providers to support that work, telling them what’s exposed and which fixes to make on a running system. Today, we’re introducing the Critical Infrastructure Defense Program , which brings frontier Claude models, on-site engineers, and our threat research to those trusted providers. Its founding partners are Accenture, Booz Allen, CrowdStrike, Deloitte, Dragos, Hitachi, Insane Cyber, Nozomi Networks, Palo Alto Networks, PwC, and Rockwell Automation. These organizations represent the providers that operators rely on to secure these systems: the consulting and advanced technology companies that run security programs, the security companies that guard the business and industrial networks, and the manufacturers that build and patch the equipment itself. This work is underway. Several partners are currently working with Claude to fix vulnerabilities and help customers do the same. Critical infrastructure is hard to defend in many ways that AI cannot fix, but we believe that frontier models can help find and repair weaknesses before those weaknesses are used to cut off power or make water unsafe. Our first step is to work with a small cohort of providers to learn which strategies are most effective and practical. If your company builds security products or services for critical infrastructure, you can register your interest here . As AI continues to advance, it presents an important opportunity to strengthen cybersecurity across critical infrastructure, provided it is applied responsibly, validated rigorously, and deployed with safety and reliability at the forefront. We are pleased to contribute our operational technology and industrial cybersecurity expertise to help develop practical approaches for applying AI in ways that strengthen the resilience of the infrastructure society depends on every day. Through our work with critical infrastructure organizations, PwC’s cyber OT practice has seen firsthand the gravity of consequences cyber breaches can have in these environments. I firmly believe that a coordinated, industry-wide effort is necessary to identify vulnerabilities, mitigate risks, and strengthen the resilience of our critical systems. Threat actors are using AI to find and exploit exposures at machine speed. By combining Unit 42 threat intelligence and operational expertise with Anthropic’s frontier models, we’re helping operators defend against adversaries looking to attack and disrupt essential services. Together, we are giving defenders the speed and precision needed to close attack paths before exposure becomes impact. Frontier AI is evolving faster than any single organization can track alone. That’s why the Critical Infrastructure Defense Program matters. It brings together the people who understand these environments with the frontier capabilities now available to defend them. We’re proud to contribute our experience and to learn alongside the other partners working to protect the systems the world depends on. The sites that need protection most, like remote substations, offshore platforms, and air-gapped plants, are exactly where traditional tools can’t reach and specialists can’t be. What no one had solved was the hours: more data than any team can work through, at more sites than any team can staff. Claude closes that gap, so our analysts and our customers’ operators spend their time on the judgment calls that keep critical systems running safely. Critical infrastructure and the people who depend on it benefit when the vendor community shares what they learn about the opportunities and challenges that AI presents to operational environments, rather than keeping that knowledge in silos. Joining Anthropic's Critical Infrastructure Defense Program is one of the ways we help align frontier AI to a collective defense strategy built around the realities of the operational technology (OT) that keeps the lights on, water safe, and transportation running. Critical infrastructure is where cyber risk becomes real-world risk. As adversaries use AI to move faster and operate at greater scale, critical infrastructure facing machine-speed threats requires machine-speed defense. By bringing CrowdStrike’s deep security context and expertise together with Anthropic’s frontier AI expertise, we can put a greater advantage in the hands of critical infrastructure defenders. Amid the rapid evolution of AI and the increasing sophistication and speed of cyber threats, ensuring cybersecurity in OT environments that support social infrastructure has become one of the highest priorities facing society today. Through participation in this program, we look forward to collaborating with Anthropic and fellow partners to further enhance cyber resilience for critical infrastructure. As AI accelerates, critical infrastructure operators need solutions that address security vulnerabilities at machine speed. Together with Anthropic, Deloitte is helping provide these enterprises with the enablement needed to close security gaps and strengthen resilience, moving at pace with the realities of frontier AI.
由 claude-code/sonnet 自動生成