利用 DNS 重绑定攻击，安全研究员成功让 Claude Code 泄露内网密钥
Teja_Swaroop · reddit · 2026-07-31
A security researcher tested Claude Code's defenses against malicious Skills, finding that while it catches obvious prompt injections, it can be bypassed using a disguised DNS rebinding attack.
Attack Mechanism
The attacker hides the malicious payload at the network layer, unreadable by the model. The Skill appears as a normal CI/CD readiness gate, but at runtime, the requested domain resolves to a private IP (e.g., 172.18.0.10) via DNS rebinding. Because the agent's environment (like curl or Python) lacks browser protections like the Same-Origin Policy, the Skill successfully reads secret data from an internal notes app and sends it to the attacker. Claude Code (Opus 4.8) flagged nothing and executed the exfiltration.
Defenses
The researcher emphasizes that model-level inference is non-deterministic and shouldn't be treated as a reliable safety layer. Recommended defenses include:
- Host level (highly recommended): Use tools like dnsmasq to prevent DNS rebinding.
- Router level: Enable DNS rebind protection.
- Service level: Place internal services behind a reverse proxy with a Host-header allowlist (though headers can be spoofed).
「编程与Agent」频道最新
- 生成式 CAD 工具 NativeCAD 提供 177 个 MCP 工具，85% 以上英文建零件需求可通过 — burhop · 2026-10-16
- Flux AI CAD 支持导入 STEP 文件后用自然语言直接改型 — burhop · 2026-10-16
- 同时开 50 个 AI 任务是充电还是烧脑?开发者吵起来了 — zack_overflow · 2026-10-16
- 创业者用 Opus 一次清掉 3 万行技术债,印证「等新模型来重构」策略 — lucasmeijer · 2026-10-16
- 日本工程师用 tmux 搭建 AI agent 组织：每项目一队，人只对接总管 — 4310sy · 2026-10-16
- Gloria AI 推出加密新闻 MCP server，可实时检索摘要 — modelcontextprotocol · 2026-10-16