Anthropic 将为其前沿 Claude 模型、工程师和威胁研究资源，提供给那些负责保护关键基础设施的公司，包括电网、供水设施和交通网络。“关键基础设施防御计划”是 Anthropic 网络使命的第一部分。该公司于周四宣布了这一计划，旨在作为一项长期努力，为防御者提供支持。
Anthropic will give its frontier Claude models, engineers and threat research to the companies that guard critical infrastructure. That means power grids, water utilities and transport networks. The Critical Infrastructure Defense Program is the first part of the Anthropic Cyber Mission. The company announced it on Thursday as a long-term effort to support defenders.
第二部分则是 OSS Scanner，这是一项免费服务，利用 Anthropic 最强大的模型扫描开源代码。该服务会将扫描结果直接发送给维护人员，无需人工先行审核。
The second part is OSS Scanner, a free service that scans open-source code with Anthropic’s strongest models. It sends the findings straight to maintainers, without a human checking them first.
十一家创始合作伙伴——埃森哲（Accenture）、布兹艾伦（Booz Allen）、CrowdStrike、德勤（Deloitte）和 Dragos——已加入该计划。此外，日立（Hitachi）、Insane Cyber、Nozomi Networks、Palo Alto Networks、普华永道（PwC）和罗克韦尔自动化（Rockwell Automation）也加入了进来。Anthropic 表示，这些公司都是运营商早已依赖的咨询机构、安全企业或设备制造商。该公司还指出，其中一些企业已经在使用 Claude 修复漏洞。
Eleven founding partners Accenture, Booz Allen, CrowdStrike, Deloitte and Dragos joined as founding partners. So did Hitachi, Insane Cyber, Nozomi Networks, Palo Alto Networks, PwC and Rockwell Automation. Anthropic said they are the consultancies, security companies and equipment makers that operators already rely on. Several are already using Claude to fix vulnerabilities, it said.
该计划主要针对运营技术：即那些能够长期运行工厂的控制器、控制软件以及工业网络。运营商通常无法将这些系统下线以进行修补，因此已知的漏洞可能持续存在多年。Anthropic 将首先与一小部分供应商合作，以了解哪些方法行之有效。
The programme targets operational technology: the controllers, control software and industrial networks that run plants for decades. Operators often cannot take these systems offline to patch them, so known flaws can stay open for years. Anthropic will start with a small group of providers to learn what works.
Anthropic 在声明中表示：“关键基础设施在许多方面都难以防御，而这些是人工智能无法解决的问题。”
“Critical infrastructure is hard to defend in many ways that AI cannot fix,” Anthropic said in its announcement.
日立在其声明中表示，将加入该计划的工作组，并分享其在运营技术方面的专业知识。这家日本集团已于 5 月与 Anthropic 签署了战略合作伙伴关系，并于 6 月加入了 Project Glasswing。
Hitachi said in its own statement that it will join the programme’s working groups. It will also share its operational technology expertise. The Japanese group signed a strategic partnership with Anthropic in May and joined Project Glasswing in June.
据 Axios 报道，Anthropic 并未说明计算资源将由谁支付，也未说明合作伙伴是否可以获得免费模型访问权限。Axios 是首家报道该消息的媒体。报道还补充说，目前尚不清楚合作伙伴如何在不对公用事业造成干扰的情况下测试修复方案。
Anthropic did not say who will pay for the computing, or whether partners get free model access, Axios reported. Axios had the announcement first. It added that it is unclear how partners will test fixes without disrupting utilities.
6月，Anthropic为美国州、地方、部落和领土政府启动了类似计划。该公司表示，此后已向美国半数以上州提供了Claude模型和技术支持。9月，OpenAI投入10亿美元支持水务公用事业和社区银行的网络防御。无人核查的漏洞报告OSS Scanner采用选择加入制，模仿Google的OSS-Fuzz。根据Frontier Red Team的一篇帖子，入选项目将获得Anthropic最强模型（包括Claude Mythos）的定期扫描。每份报告均附带概念验证、解释，并在可能的情况下提供建议补丁。
In June, Anthropic started a similar programme for US state, local, tribal and territorial governments. It said it has since given Claude models and technical support to more than half of US states. OpenAI put $1bn behind cyber defence for water utilities and community banks in September. Bug reports no human has checked OSS Scanner is opt-in and modelled on Google’s OSS-Fuzz. Enrolled projects get periodic scans from Anthropic’s most capable models, including Claude Mythos, according to a Frontier Red Team post. Each report carries a proof of concept, an explanation and, where possible, a suggested patch.
Anthropic预计超过90%的发现属实。其渗透测试人员核查了来自48个项目的97个关键和高严重级别发现。其中，85个符合其披露流程标准。另有11个虽属实但属于已知重复问题，仅1个为误报。
Anthropic expects more than 90% of the findings to be real. Its penetration testers checked 97 critical and high-severity findings from 48 projects. Of those, 85 met the bar for its disclosure process. Another 11 were real but repeated known issues, and only one was a false positive.
六个月内，Anthropic的模型标记了超过29,000个候选漏洞。其员工仅能审查约6,000个。近5,000份未经核查的报告被发送给了要求接收所有报告的维护者。
Over six months, Anthropic’s models flagged more than 29,000 candidate vulnerabilities. Its staff could only review about 6,000. Nearly 5,000 unchecked reports went to maintainers who asked to receive everything.
wolfSSL的Todd Ouska表示，其项目收到74份报告，除两份外均为有效。其中五个已分配CVE编号。
Todd Ouska of wolfSSL said his project got 74 reports and all but two were valid. Five became CVEs.
curl的Daniel Stenberg表示：“OSS Scanner帮助我们在curl中发现了多个值得修复的问题，包括过去几年中报告的最严重curl漏洞之一。”
“OSS Scanner has helped us find multiple issues in curl worthy of addressing, including one of the worst curl vulnerabilities reported in the last few years,” said Daniel Stenberg of curl.
Anthropic逐个项目甄选，仅接纳对基础设施和用户安全具有关键影响的成熟项目。其服务协议警告称，报告可能误判严重程度，或提出会破坏功能的补丁。维护者必须审查每份报告，Anthropic将责任上限设为1,000美元。Anthropic的消费者条款同样适用。攻击者暂时领先Anthropic表示：“我们的预测是，两年内AI将有利于防御方。”
Anthropic picks projects case by case, and only takes established ones with a critical impact on infrastructure and user security. Its service agreement warns that reports may misjudge severity or propose patches that break things. Maintainers must review every report, and Anthropic caps its liability at $1,000. Anthropic’s consumer terms also apply. Attackers ahead for now“Our forecast is that in two years, AI will favor defense,” Anthropic said.
该公司补充说，这种情况在短期内可能并不成立。利用漏洞的成本已经降低，而验证和修复漏洞仍然依赖于人力。在Glasswing，发现漏洞与修复漏洞之间往往要间隔数月，而在运行中的设备上，修复工作在某些罕见情况下甚至可能需要等待数十年。
The company added that this may not hold in the near term. Exploiting flaws has become cheaper, while verifying and fixing them still depends on people. In Glasswing, months often passed between finding a flaw and fixing it, and on running machinery a fix can in rare cases wait decades.
上周，Anthropic表示，一款中国模型在网络安全攻击方面的表现几乎与Mythos相当。本周，该公司将Glasswing整合到了其扩展后的网络验证计划中。其于8月推出的Defender Advantage Fund确保了OSS Scanner能够免费使用。
Last week Anthropic said a Chinese model nearly matches Mythos at cyber exploits. This week it merged Glasswing into its expanded Cyber Verification Program. The Defender Advantage Fund it launched in August keeps OSS Scanner free.
Anthropic还通过Linux基金会为Python软件基金会、Apache软件基金会以及Alpha-Omega和OpenSSF提供了资金支持。作为新合作伙伴之一的CrowdStrike，已经与这两家实验室展开了合作。
Anthropic has also funded the Python Software Foundation, the Apache Software Foundation, and Alpha-Omega and OpenSSF through the Linux Foundation. CrowdStrike, one of the new partners, already works with both labs.