Anthropic 将其 Claude 模型指向 25 个广泛使用的开源项目，并设定了一个不同的任务：不是寻找单个漏洞，而是寻找攻击者在本不应能访问的情况下仍可触达的代码。Claude 标记出了 493 个此类问题。其中一个问题已在软件中潜伏了 21 年。
Anthropic pointed its Claude models at 25 widely used open-source projects and set them a different task: not finding individual bugs, but finding code that attackers can reach when they should not be able to. Claude flagged 493 such issues. One of them had sat in the software for 21 years.
这项工作是 Anthropic 前沿红队研究的预览，由安全工程师 Chris Rohlf 撰写，于周一发布。Anthropic 称这种方法为“攻击面缩减”。
The work is a preview of research from Anthropic’s Frontier Red Team, written up by security engineer Chris Rohlf and published on Monday. Anthropic calls the approach attack surface reduction.
它不是逐个修复缺陷，而是绘制特定部署实际暴露的代码图谱，然后移除或设置门控，限制该部署不需要暴露的任何内容。Anthropic 表示，这在无需发现任何单一漏洞的情况下，降低了未知漏洞的严重性。
Instead of fixing flaws one by one, it maps the code a given deployment actually exposes, then moves or gates anything that deployment does not need to expose. That lowers the severity of unknown vulnerabilities, Anthropic said, without having to find a single one.
Claude 扫描了超过 500 万行 C、C++、Java、PHP 和 Python 代码。Anthropic 称，它构建了包含 17,000 多个配置选项的清单。其中，3,842 个涉及安全控制。公司将这 25 个项目分为三组：面向所有人的公共服务、需要认证的受控服务，以及供运营商自用环境使用的私有工具。
Claude ran across more than five million lines of C, C++, Java, PHP and Python. It built an inventory of over 17,000 configuration options, Anthropic said. Of those, 3,842 touched a security control. The company sorted the 25 projects into three groups: public services open to anyone, gated ones that require a, and private tools for an operator’s own environment.
Claude 的发现 受控项目产生了最显著的结果。Anthropic 称，所有 11 个受控项目都存在用户登录前即可触达的代码。Claude 统计出 93 个不必要的预认证攻击面。它发现了 37 处在用户登录前即运行代码或保存状态的位置。它标记了 61 个配置组合，这些组合会在管理员不知情的情况下削弱其设置的安全控制。
What Claude found The gated projects produced the sharpest results. All eleven had code reachable before a user logged in, Anthropic said. Claude counted 93 unnecessary pre-authentication surfaces. It found 37 places where code ran, or saved state, before a user logged in. It flagged 61 configuration combinations that silently weakened a control an administrator had set.
配置冲突是最引人注目的主题。Claude 发现了 162 个软件在无任何错误或警告下接受的安全敏感选项组合。其中 94 个组合会静默地关闭一项安全控制。一种模式在四个无关项目中独立出现。一条使用主机名编写的拒绝规则，当服务器关闭反向 DNS 查找时，可能会“失败开放”，从而放行原本旨在阻止的客户端。
The configuration clashes were the most striking theme. Claude found 162 security-sensitive option combinations that the software accepted with no error or warning. In 94 of them, the pairing silently switched a security control off. One pattern turned up independently in four unrelated projects. A deny rule written with a hostname could fail open, letting through the very clients it was meant to block, when the server had reverse DNS lookups switched off.
这是一个存在了21年的问题，源于两个设置之间的冲突。其中一个设置要求每个客户端都必须用证书证明身份。另一个设置本意只是延迟该检查，却将其彻底关闭。Anthropic表示，因此，设置为仅接受受信任客户端的服务器实际上会接受任何人。文档从未提及它已取消证书要求。这一冲突在代码中潜伏了21年。
The 21-year-old issue was a conflict between two settings. One required every client to prove its identity with a certificate. The other, meant only to delay that check, switched it off entirely. A server set to accept only trusted clients would therefore accept anyone, Anthropic said. The documentation never mentioned that it had dropped the certificate requirement. The clash had sat in the code for 21 years.
即使是OpenSSH 相对于项目体量而言，最大的缩减出现在OpenSSH中。它是保障远程服务器访问安全的C语言程序，也是世界上经过审计最严格的代码库之一。Anthropic表示，Claude追踪了10.4版本中的SSH守护进程，发现大约4500行新的后量子签名代码，未经身份验证的客户端默认即可触达，即使管理员已排除该算法也是如此。这约占守护进程预认证代码的16%。Anthropic连同补丁报告了该问题，维护者在10.5和10.6版本中发布了修复。
Even OpenSSH The biggest reduction, measured against a project’s size, came in OpenSSH. It is the C program that secures remote server access, and some of the most heavily audited code in the world. Claude traced the SSH daemon in the 10.4 release. It found roughly 4,500 lines of new post-quantum signature code that an unauthenticated client could reach by default, Anthropic said, even when an administrator had excluded the algorithm. That is about 16% of the daemon’s pre-authentication code. Anthropic reported it with patches, and the maintainers shipped fixes across the 10.5 and 10.6 releases.
Anthropic写道：“OpenSSH是世界上经过审计最严格的代码库之一。如果不必要的可触达性能在那里存活，它就能在任何地方存活。”这一发现获得了外部研究人员的认可。攻击面缩减是唯一可靠有效的方法。
“OpenSSH is some of the most heavily audited code in the world. If unnecessary reachability survives there, it can survive anywhere,” Anthropic wrote. The finding drew approval from outside researchers. Attack surface reduction is the one thing that reliably works.
2026年10月21日 Rohlf将该技术定位为利用AI防御代码的实用手段，而非仅用于攻破代码。
October 21, 2026 Rohlf framed the technique as a practical use of AI to defend code, not only to break it.
今年早些时候，我们指派Claude自主绘制并缩减25个大型且广泛使用的开源代码库的攻击面。
Earlier this year we tasked Claude with autonomously mapping and reducing the attack surface of 25 large and widely used OSS codebases.
局限性与时机 Anthropic坦诚地说明了局限性。该公司表示，这些技术无法消除未知漏洞，只能让它们更难触达，从而降低其严重程度。结果来自Anthropic自身的预览测试，而非独立测试。至少OpenSSH的修复已在项目的发行说明中公开，文中将该工作归功于Anthropic和Claude。
A limit, and the timing Anthropic was candid about the limits. The techniques do not remove unknown vulnerabilities, it said. They only make them harder to reach, and so cut their severity. The results are Anthropic’s own, from a preview rather than independent testing. The OpenSSH fixes, at least, are public in the project’s release notes, which credit the work with Anthropic and Claude.
Anthropic 表示，已将这三种技术整合为一个可复用的 Claude 技能，并正致力于将其添加到其 OSS Scanner 中。这篇文章是 AI 发现漏洞研究的最新成果，此前 Claude 曾针对 Firefox 发现 271 个漏洞，也是 AI 实验室在网络防御领域更广泛竞争的一部分。该文章发布的前一天，一个 AI 辅助发现的 PHP 漏洞导致大部分网络忙于修补。
Anthropic said it has folded the three techniques into a reusable Claude skill, and is working to add it to its OSS Scanner. The post is the latest in a run of AI-finds-flaws research, after Claude’s earlier work on 271 Firefox bugs, and part of a wider race between AI labs over cyber defence. It also landed a day before an AI-assisted PHP flaw sent much of the web scrambling to patch.