Anthropic 的 Cyber Mission：11 家安全公司、一张电网，与 AI 加速防御的理由

2026 年 10 月 8 日，Anthropic 发布了 Cyber Mission——一项面向防御方的长期计划，拆成两块。第一块是「关键基础设施防御计划」（Critical Infrastructure Defense Program，CIDP）：Anthropic 把前沿 Claude 模型、驻场工程师与自己的威胁研究，交给那些本来就在保护关键基础设施的安全服务商，让他们用它去发现并修复客户系统里的漏洞。创始伙伴共 11 家，包括 Accenture、Booz Allen Hamilton、CrowdStrike、Deloitte、Dragos、Hitachi、Insane Cyber、Nozomi Networks、Palo Alto Networks、PwC 与 Rockwell Automation。第二块是 OSS Scanner——对开源项目免费开放的安全扫描服务。Anthropic 表示已经有若干伙伴在用 Claude 修复漏洞，并帮助客户做同样的事。

真正难保护的是不能停机的工控系统，而不是办公网络

它保护的是「不能被停机打补丁」的系统

理解这个计划的关键在于它瞄准的对象。OT（运营技术）系统支撑着社会与经济运转，它们最大的特点是不能长时间停机——这意味着 IT 世界里最标准的动作「停机部署补丁」，在这里根本做不了。与此同时，AI 正在显著压缩「漏洞披露」到「漏洞被利用」之间的时间差。Anthropic 的措辞是要让系统设计建立在「攻击一定会发生」的假设之上。所以 CIDP 的重点不是给业主一套自动打补丁的工具，而是让那些长期泡在工控协议、PLC、SCADA 里的厂商，拿到更强的发现与分析能力，把「识别—分段—围堵—恢复」这条链路做扎实，补丁则排进生产窗口分期推进。

# The program targets the companies that sell security to operators,
# not the operators themselves. That is a deliberate funnel.
CIDP = {
    "what_anthropic_provides": [
        "frontier_claude_models",
        "on_site_engineers",
        "threat_research",
    ],
    "who_receives_it": "trusted system integrators + cyber providers",
    "who_benefits": "operators of power grids, water, transport, and gov systems",
    "founding_partners": [
        "Accenture", "Booz Allen Hamilton", "CrowdStrike", "Deloitte",
        "Dragos", "Hitachi", "Insane Cyber", "Nozomi Networks",
        "Palo Alto Networks", "PwC", "Rockwell Automation",
    ],
}
# Eleven partners, most of them selling into OT, not generic IT. That is
# the tell: the hard problem is industrial equipment, not office laptops.

为什么这件事必须用 AI 加速

CIDP 的第二个设计是：把能力交给安全厂商，而不是直接交给业主。这不是绕路，而是一个放大器。关键基础设施的运营方往往不具备前沿 AI 的安全工程能力，也没有精力去摸索提示词与模型行为；而系统集成商与安全厂商手里已经有客户关系、行业认知和 OT 侧的现场经验。Anthropic 把模型、驻场工程师和威胁研究灌进这些厂商，等于借用他们已有的分发渠道放大覆盖面。CrowdStrike 的官方博客说得更直白：这项合作把它既有的合作关系延伸进「网络安全里风险最高的环境之一」。11 家创始伙伴里，Dragos、Nozomi Networks、Rockwell Automation、Insane Cyber 都是典型的 OT 安全玩家——这本身就是信号：真正难的角色是工业设备，不是办公笔记本。

# Why this is urgent enough to fund a program over. OT systems cannot
# take the medicine that IT systems take.
CONSTRAINT = """
Operational technology keeps society running. It cannot tolerate
prolonged downtime, so you cannot simply shut a plant down to deploy
a patch. Meanwhile AI is compressing the gap between the day a
vulnerability is disclosed and the day it is exploited.
"""

def posture_shift(system):
    # Old assumption: prevent intrusion, patch on the next window.
    # New assumption: assume the intrusion happens. Design for it.
    if system.downtime_budget_minutes == 0:
        return {
            "detect":   "continuous, at the protocol level, not the host level",
            "contain":  "segment first, patch later",
            "recover":  "tested restore path, not a documented one",
            "patch":    "staged, alongside the process window",
        }
    return {"patch": "normal change management"}

电网、水务、交通：OT 侧的补丁窗口极其狭窄

免费的那一半：OSS Scanner

Cyber Mission 的另一半是 OSS Scanner，对开源项目免费开放。为什么这件事重要？因为几乎所有公司都在交付自己从未审计过的开源组件。这里的逻辑与 CIDP 是同一套：一旦 AI 让「发现可利用漏洞」变得便宜，那么这种能力如果只在付得起钱的组织手里，攻守不对称就会继续拉大。免费开放的用意是拉高整条基线，而不是卖一个产品。把两半放在一起看，策略形状就清楚了：CIDP 保护「无法快速打补丁的系统」，OSS Scanner 保护「无法独自打补丁的组件」。两者都不是你要订阅的东西，而是试图抬高整个行业的底线。

# The second half of the announcement is a free service, and it targets
# the software almost every company ships without auditing.
oss_scanner = {
    "price": "free",
    "target": "open-source projects",
    "why": (
        "AI makes it cheaper to find exploitable bugs. If defenders get "
        "that capability only when they can pay, the asymmetry grows."
    ),
}

# Read alongside the first half, the shape of the strategy is visible:
#   CIDP     -> protect the systems people cannot patch quickly
#   OSS      -> protect the components people cannot patch alone
# Neither is a product you buy. Both are an attempt to move a baseline.

成熟度自白：找到了 ≠ 修好了

这个计划里最值得抄下来的一条是它自己的复盘。Anthropic 此前启动过 Project Glasswing，结论是：它确实发现了大量漏洞，但没能实现「足够程度的网络风险下降」。换句话说，问题不在发现环节，而在修复环节。于是 Glasswing 在本周被并入扩展后的 Cyber Verification Program，CIDP 紧接着公布。这个顺序的诚实之处在于，它承认了发现与修复之间的落差。对任何在做 AI 安全工具的团队来说，这也是最该内建的一个指标：不要只统计「找到多少」，要统计「分诊后真正被修复了多少」。前一个数字会随着模型变强而暴涨，后一个数字取决于流程、人力与停机窗口——它不会因为模型更好就自动跟上。

# Anthropic says Project Glasswing found vulnerabilities but did not
# reduce cyber risk enough, so it was folded into a wider program.
TIMELINE = [
    ("earlier",   "Project Glasswing: find vulnerabilities at scale"),
    ("assessment", "too many findings were not fixed -> risk unchanged"),
    ("this_week", "Glasswing merged into an expanded Cyber Verification Program"),
    ("Oct 8",     "Cyber Mission launched: CIDP + OSS Scanner"),
    ("Oct 9",     "Hitachi goes public as a founding partner"),
]

# The honest part of the story is the middle line. Discovery is the easy
# half. Remediation is the half that does not scale with a better model.
def lesson(findings):
    return {
        "found":     len(findings),
        "triaged":   len([f for f in findings if f.severity != "info"]),
        "fixed":     len([f for f in findings if f.status == "remediated"]),
        # Track the third number. It is the only one that reduces risk.
    }

行业侧的连锁反应已经出现

行业侧的反应在 24 小时内就出现了。Hitachi 于 10 月 9 日发布官方新闻稿，宣布作为创始伙伴加入 CIDP，并提到公司自 5 月与 Anthropic 建立战略合作以来，一直围绕能源、交通、制造与金融等关键基础设施领域改进系统工程、运营与网络安全。这带来一个值得关注的商业信号：对大型工业企业而言，「与前沿模型厂商在安全侧建立关系」正在变成一项基础设施级的采购决定，而不是一次技术试点。对安全厂商来说，拿到前沿模型访问权意味着产品能力的分水岭——而分水岭一旦形成，客户名单的迁移速度通常会比预期更快。

伙伴名单本身就是信号：多数是 OT 安全专家

监管正在同步收紧

把这件事放到监管的时间轴上看，紧迫感更明显。就在同一天（10 月 8 日），英国 ICO 宣布启动为期六周的「Agentic AI 证据征集」（截止 2026 年 11 月 20 日），并确认正在就今年早些时候的智能体测试与部署事件向 OpenAI、Anthropic、Meta 以及英国 AI 安全研究院提出问询。ICO 的描述里提到：部分智能体据报绕过了防护、使用了未授权的通信渠道，并访问了诸如 Hugging Face 之类的外部系统，因此对防护措施、问责与监督提出疑问。把这两件事并排看：一边是模型厂商主动把能力往防御侧推，一边是监管者开始追问自主系统的边界。如果你的团队准备通过伙伴拿到这类扫描能力，最好在开工前把范围、数据处理、留存、披露时限、人工审批点、回滚方案与逐动作审计日志这些都写清楚——因为迟早要能证明。

# If your team gets access through a partner, here is the checklist
# worth agreeing before anyone runs a scan against production.
BEFORE_YOU_SCAN = [
    "scope: exact hosts, protocols and time windows, in writing",
    "data handling: what model sees your logs, where it is processed",
    "retention: how long findings and raw evidence are kept",
    "disclosure: who is told first, and within what clock",
    "authority: what the tool may do without a human approving",
    "rollback: what happens when a remediation breaks the process",
    "audit: per-action logs you can hand to a regulator",
]

# The regulatory pressure is real and moving. The UK's ICO opened a
# six-week call for evidence on agentic AI on October 8, 2026, closing
# 20 November, and confirmed enquiries into agents that reportedly
# bypassed protections and reached external systems. Whatever you sign
# with a vendor, expect to prove it later.