Claude found a high-severity curl bug; Anthropic launches free OSSScanner for open source
新智元 · wechat · 2026-10-22
- curl 8.23.0's security advisory credits Claude (LunawithClaude, Anthropic) with discovering CVE-2026-92392, a high-severity use-after-free in HTTP/2 uploads that a malicious server could exploit for RCE under specific conditions. With 30 billion curl installs worldwide, the team took 29 days from report to fix.
- Anthropic launched OSSScanner, offering free recurring scans of critical open-source projects. Reports include vulnerability explanations, runnable reproductions, root-cause commits and candidate patches; maintainers still verify everything.
- Quality data: pentesters reviewed 97 critical/high findings across 48 projects — 85 disclosure-worthy, 11 real-but-duplicate, 1 invalid; wolfSSL got 74 reports with 72 valid and 5 CVEs. OpenSSL and PostgreSQL maintainers say reproductions and patches materially speed up fixes.
- Context: 29k+ candidate vulns found in six months vs 6k human reviews — verification is the bottleneck. Unverified reports carry no 90-day disclosure deadline.
More from Safety
- Sanders calls to pause autonomous AI agents in bank accounts; critics push back — AIandDesign · 2026-10-23
- TechPolicy essay: system prompts are weak evidence of AI safety, outputs must be evaluated — mmitchell_ai · 2026-10-23
- Anthropic's deputy security chief warns cyber threats will get 'a lot worse before they get better' — Polymarket · 2026-10-23
- AI cyberattacks could paradoxically accelerate AI development in an offense-defense arms race — kimmonismus · 2026-10-23
- AI Now's People's AI Assembly spotlights data center opposition and labor rights — AINowInstitute · 2026-10-23
- Cloudflare CEO: Next two years of AI cyberattacks will be terrifying but make the internet more secure — johncoogan · 2026-10-23