利用 DNS 重绑定攻击，安全研究员成功让 Claude Code 泄露内网密钥
Teja_Swaroop · reddit · 2026-07-31
A security researcher tested Claude Code's defenses against malicious Skills, finding that while it catches obvious prompt injections, it can be bypassed using a disguised DNS rebinding attack.
Attack Mechanism
The attacker hides the malicious payload at the network layer, unreadable by the model. The Skill appears as a normal CI/CD readiness gate, but at runtime, the requested domain resolves to a private IP (e.g., 172.18.0.10) via DNS rebinding. Because the agent's environment (like curl or Python) lacks browser protections like the Same-Origin Policy, the Skill successfully reads secret data from an internal notes app and sends it to the attacker. Claude Code (Opus 4.8) flagged nothing and executed the exfiltration.
Defenses
The researcher emphasizes that model-level inference is non-deterministic and shouldn't be treated as a reliable safety layer. Recommended defenses include:
- Host level (highly recommended): Use tools like dnsmasq to prevent DNS rebinding.
- Router level: Enable DNS rebind protection.
- Service level: Place internal services behind a reverse proxy with a Host-header allowlist (though headers can be spoofed).
「编程与Agent」频道最新
- Plannator 发布技能：用 HTML 生成 Agent 交互原型 — tom_doerr · 2026-08-24
- DocketBird MCP 服务器：支持搜索下载法院文档 — modelcontextprotocol · 2026-08-24
- AgentLux MCP 服务器：支持市场和社交流程 — modelcontextprotocol · 2026-08-24
- MongoDB 发布 Agent 工具包，让编码助手精通数据库 — TheTuringPost · 2026-08-24
- 开发软件前先让 Agent 查开源库，99% 的情况是正解 — generativist · 2026-08-24
- 开发者瓶颈不在 AI 上下文，而在人脑认知负荷 — Vidhrohi · 2026-08-24