{"@context":"https://schema.org","@type":"NewsArticle","generatedAt":"2026-07-23T06:40:50.084Z","headline":"Anthropic 如何保障AI原生软件开发生命周期的安全","description":"Anthropic副首席信息安全官Jason Clinton披露，其软件工程师每季度交付的代码量是2021-2025年平均水平的8倍，Claude编写了约80%合并入库的代码。安全团队通过安全左移、硬访问与身份边界、自动化与智能体审查结合、关键节点引入人工审核等策略，应对被入侵或提示注入的智能体引入恶意变更等威胁，同时不显著拖慢开发速度。","url":"https://www.aioga.com/news/cmruye3wf00qubinv8iptndu9/","mainEntityOfPage":"https://www.aioga.com/news/cmruye3wf00qubinv8iptndu9/","datePublished":"2026-07-20T16:00:00.000Z","dateModified":"2026-07-20T16:00:00.000Z","inLanguage":"zh-CN","publisher":{"@type":"NewsMediaOrganization","name":"Aioga","url":"https://www.aioga.com"},"citation":["https://claude.com/blog/how-anthropic-secures-its-ai-native-software-development-lifecycle","https://aihot.virxact.com/items/cmruye3wf00qubinv8iptndu9"],"canonicalUrl":"https://www.aioga.com/news/cmruye3wf00qubinv8iptndu9/","directAnswer":{"@type":"Answer","text":"Anthropic披露，工程师每季度交付代码量达到2021至2025年平均水平的8倍，约80%的合并代码由Claude编写。其安全体系同步扩展审查、监控和其他流程，以适应更高的代码产出与部署速度。","url":"https://www.aioga.com/news/cmruye3wf00qubinv8iptndu9/","dateCreated":"2026-07-20T16:00:00.000Z","author":{"@type":"Organization","@id":"https://www.aioga.com/authors/aioga-editorial/#editorial-team","name":"Aioga Editorial Team","url":"https://www.aioga.com/authors/aioga-editorial/"}},"evidence":[{"@type":"CreativeWork","name":"Claude：Blog（网页） source article","url":"https://claude.com/blog/how-anthropic-secures-its-ai-native-software-development-lifecycle","datePublished":"2026-07-20T16:00:00.000Z","provider":{"@type":"Organization","name":"Claude：Blog（网页）","url":"https://claude.com/blog/how-anthropic-secures-its-ai-native-software-development-lifecycle"}},{"@type":"CreativeWork","name":"AIHot archive record","url":"https://aihot.virxact.com/items/cmruye3wf00qubinv8iptndu9","datePublished":"2026-07-20T16:00:00.000Z","provider":{"@type":"Organization","name":"AIHot","url":"https://aihot.virxact.com/items/cmruye3wf00qubinv8iptndu9"}}],"aggregationSource":"Claude：Blog（网页）","originalPublisher":{"name":"Claude：Blog（网页）","url":"https://claude.com/blog/how-anthropic-secures-its-ai-native-software-development-lifecycle"},"article":{"id":"cmruye3wf00qubinv8iptndu9","slug":"cmruye3wf00qubinv8iptndu9","url":"https://www.aioga.com/news/cmruye3wf00qubinv8iptndu9/","title":"Anthropic 如何保障AI原生软件开发生命周期的安全","title_en":"How Anthropic Secures Its AI-Native Software Development Lifecycle","summary":"Anthropic副首席信息安全官Jason Clinton披露，其软件工程师每季度交付的代码量是2021-2025年平均水平的8倍，Claude编写了约80%合并入库的代码。安全团队通过安全左移、硬访问与身份边界、自动化与智能体审查结合、关键节点引入人工审核等策略，应对被入侵或提示注入的智能体引入恶意变更等威胁，同时不显著拖慢开发速度。","source":"Claude：Blog（网页）","sourceUrl":"https://claude.com/blog/how-anthropic-secures-its-ai-native-software-development-lifecycle","aiHotUrl":"https://aihot.virxact.com/items/cmruye3wf00qubinv8iptndu9","publishedAt":"2026-07-20T16:00:00.000Z","category":"技巧观点","score":67,"selected":true,"articleBody":["Anthropic Deputy CISO, Jason Clinton, details how the Security Engineering team secures a SDLC that has AI authoring 80% of merged code.","At Anthropic, the amount of code and velocity of deployment have scaled exponentially. Our software engineers on average ship 8x as much code per quarter as they did from 2021 to 2025.","Our reviews, monitoring, and other security processes needed to scale alongside this increased pace. Otherwise it becomes a formula for bottlenecks (Amdahl’s Law：https://en.wikipedia.org/wiki/Amdahl%27s_law).","Our software development processes have changed drastically as well. Claude has evolved from coding assistant to primary creator and reviewer. Claude authors：https://www.anthropic.com/institute/recursive-self-improvement about 80% of the code merged into our codebase today.","More than half of all code is being merged by our internal version of Claude Tag：https://www.anthropic.com/news/introducing-claude-tag while human engineers focus on directing, setting intent, and owning final approval.","This means our security team must defend a rapidly expanding surface area and harden a lifecycle with non-deterministic, constantly evolving agents at its heart. In this article, I cover strategies to secure the software development lifecycle (SDLC).","(This is intended to be combined with the Zero Trust for Agents ：https://claude.com/blog/zero-trust-for-ai-agents framework we recently published; everything in this article uses security design ideas from that framework in the implementation).","The threats we're designing against are specific: a compromised or prompt-injected agent introducing a malicious change; supply-chain and dependency poisoning that an agent ingests as trusted input; and the more familiar classes of application vulnerability now arriving at higher volume. Every control that follows maps to at least one of those.","There are several overarching strategies we’ve deployed to accomplish this without significantly throttling dev velocity including:","In this article, we’ll cover the security processes we have implemented at specific stages of the software development lifecycle as well as the core principles behind them. These principles are more enduring as security teams must reexamine, and often reinvent, their processes as model capabilities evolve.","Our development team has covered the changes to their software development lifecycle at length：https://claude.com/blog/running-an-ai-native-engineering-org, so this will be a brief primer before we dive into each stage.","At a high level, our software development lifecycle is compressed. It is driven by prototypes and internal adoption (dogfooding) more than lengthy planning cycles. Ideation comes from all corners of the organization and traditional roles (frontend, backend, design) are blurred. Reviews and approvals still have humans in the loop, but are also driven by agentic loops.","While each stage has been fundamentally transformed and accelerated by Claude Code and Claude Tag, the names and purposes of each stage wouldn’t look alien to a developer coming from a more traditional organization. These are natural gates that we also use as part of our security processes for an AI-native SDLC.","One of our first security automations ever was a simple Claude Opus powered PSR (project security review) web application. It ingested a project design document and analyzed it against the MITRE ATT&CK framework：https://attack.mitre.org/ to identify potential vulnerabilities and suggested mitigations.","We’ve significantly enhanced the system by connecting it to an internal knowledge index that provides much deeper context across our organization-wide policies, past decisions, and related systems.","This gives us a better understanding of potential risk, and it also captures information missing from the PSR. This one implementation saved the majority of the AppSec team’s time. Once we gained confidence that Claude was accurate in assessing risk, we allowed teams to approve their own project, if Claude deemed the launch low enough risk.","Here we can see one of the first key adaptations to an AI-native SDLC. A PSR was originally designed to catch security issues before the lengthy and expensive coding process. Catching an issue at this stage saved months of re-development.","Today, multiple prototypes of major features can be created in hours, making detailed architectural review a less critical gate. Connecting our PSR application to our knowledge index captures context that could otherwise be missed without creating an unnecessary speed bump. Creating a Claude Code skill allowed Claude to further fan out and capture additional context wherever it lived.","Enduring Principle : Connect security agents to organizational context. As the planning cycle compresses, it is much more effective to bring these agents to where the context already lives – chat threads, prior reviews, the codebase – rather than forcing detailed documentation at stages that may no longer require them. Either way, agents need context outside of the code itself.","Security professionals within an AI-native engineering organization have a new lever: they can directly shape how code is created, helping to prevent vulnerabilities at the source.","Previously, teams observed recurring vulnerabilities and created secure coding guidelines to address them, but those guidelines were difficult to enforce and rarely standardized.","At Anthropic, those guidelines are encoded in CLAUDE.md files and references to org-wide skills so the code follows these best practices the minute it's generated. This is done as part of a closed loop. Once an agent discovers a bug class, the relevant file is updated to prevent it recurring in future code.","Of course, that doesn’t mean all code comes out perfect. Our team started with a CLAUDE.md file that instructs the agent to run /security-review：https://support.claude.com/en/articles/11932705-automated-security-reviews-in-claude-code as a final step before opening a PR. This generally available command, the productized version of our team's internal review workflow, looks for places where potential attacker-controllable input enters, scans for suspicious links, and then verifies its findings.","Today, these reviews take place while Claude generates the code. Once a security guidance plugin：https://code.claude.com/docs/en/security-guidance is installed, Claude reviews the conversation and code as it goes. It suggests security improvements and addresses common vulnerabilities in the same session as it generates the code.","Other nudges at PR-time push internal, non-technical teams towards hosting their app on our low-code app-hosting platform, avoiding shadow IT that had traditionally plagued security teams.","Some of our customers choose to integrate /security-review：https://support.claude.com/en/articles/11932705-automated-security-reviews-in-claude-code with a PreToolUse hook, which makes this step a harder gate. That is also effective, but our team has chosen to incorporate our hard code review gate at the test/CI stage of the cycle.","In addition to shaping and reviewing code, containing the blast radius is one of our primary concerns at this stage. We do this by setting hard boundaries around identity (more on that in the monitor section) and setting our devs up to code on virtual machines.","Moving our coding to remote VMs was a relatively painless shift and gave us increased control and visibility compared to laptops alone. Agent traffic on these VMs is egress-allowlisted.","These tight egress controls matter especially when the agent is reading untrusted input which can carry a prompt-injection payload. An injected instruction can’t reach arbitrary destinations on the internet: exfiltration paths are limited to a small set of monitored services.","Here again you can see a clear adaptation for an AI-native SDLC. Remote coding was previously used mainly to contain IP, and today we’re seeing more mature AI coding teams adopt these environments as a means to contain agents.","Enduring Principle : Shifting left in an AI-native engineering organization means closing the loop between vulnerability discovery and updating instructions to customize how Claude generates code. Limit the blast radius (Principle of Least Agency) and what an agent can access with hard boundaries as appropriate.","In my experience, the test or CI stage quickly becomes the most painful bottleneck for engineering teams in the midst of an AI-native transformation. At Anthropic, once most developers were using agentic coding tools and running multiple agents at one time, it quickly became obvious the team could only move as quickly as humans could review code.","Let’s be clear: human accountability is still central to our process. What we did was accelerate the review process by combining automated agentic and deterministic reviews, while reserving human review for regulated or truly critical code.","Historically, human code review has been held as the standard, yet the empirical evidence：https://link.springer.com/chapter/10.1007/978-3-642-36563-8_14 has shown it is not perfect. Security bugs regularly ship in software across the world. Our review process is able to review more code and catch particularly complex issues, helping to reduce these risks.","The share of PRs that get substantive review comments has grown from 16 to 54%：https://claude.com/blog/code-review as we’ve gained confidence in the findings by requiring the agents to write a proof that their finding is valid. We’ve also determined that approximately a third of the bugs behind past claude.ai incidents would have been caught ：https://www.anthropic.com/institute/recursive-self-improvementby the automated processes we have now implemented.","We’re not the only organization that has found this to be true. Intercom has shared：https://www.intercom.com/blog/ai-is-approving-our-pull-requests-heres-how-we-made-it-safe/ it auto-approves 19% of its PRs. Deployment doubled while downtime from breaking code changes dropped 35%. CircleCI reached a similar conclusion building Chunk, an autonomous agent on Claude that resolves CI/CD maintenance issues and validates its own fixes before a human ever sees them. The：https://claude.com/customers/circleci approach doubled the rate at which agent tasks convert into completed pull requests.","When a PR is opened at Anthropic, multiple agents automatically review it. Each review agent is designed and scoped to a specific, narrow focus and leverages RAG for additional context and memory surrounding past incidents.","This is much more effective than one mega-prompt or super security agent for a few reasons:","To be clear, agents aren't merging code to production unchecked. We tier our codebase by risk, and make deliberate decisions on what parts to automate. Entire codebases have strict human approval processes.","Human accountability is still central for code that is reviewed and merged by Claude. Every approval is logged with the signals and reasoning behind it, and a risk-weighted sample is reviewed by humans. Another round of testing focuses on invariants like “user A can never read user B’s data,” and triggers additional manual reviews.We combine our agentic scans with SAST tools as well, which post directly on PRs.","Most scanning approaches, whether agentic or deterministic, are consumption based. Costs will increase as code throughput increases, and teams will need to decide what level of coverage is appropriate for them.","At Anthropic, we accept costs here will grow as our code velocity increases, but anticipate unit cost will fall. Models today are much better at coding than all models from a few years ago, and we anticipate that this pattern will continue.","Enduring Principle : Automated reviews are a different type of risk that is controlled differently (through multiple gates and agents with separate context windows). Humans stay in the loop, but may be in different places in the lifecycle depending on the nature of the codebase.","Anthropic maintains a robust staging environment where we execute common security best practices such as external pentesting for major launches and periodic DAST scans to catch logic bugs that static scans have missed or can’t see.","Like the other SDLC stages, AI presents both new challenges and solutions for security teams. On one hand, fewer vulnerabilities reach this stage. On the other, the vulnerabilities that do survive are among the most subtle and difficult to catch.","Combine that with larger volumes of code being shipped more frequently, and periodic dynamic testing doesn’t seem so dynamic anymore.","The good news is that AI models are better on the multi-step, cross-component reasoning that can catch a greater percentage of these complex vulnerabilities. For example, in February, we disclosed that Claude discovered and helped to fix more than 500 high-severity OSS vulnerabilities：https://www.anthropic.com/research/zero-days.","At Anthropic, we are implementing continuous AI-powered DAST scans in our staging environment. These look for vulnerabilities at the system level where the assumptions between two or more services are incorrect. There are a number of vendors that offer these capabilities today.","Enduring Principle : Dynamic testing should match deployment cadence.","As any good security team knows, the job isn’t done once code is pushed to prod. We can assume any vulnerability will be quickly identified by increasingly sophisticated attackers.","Our security team has implemented programs here that are standard practice such as a public bug bounty program：https://hackerone.com/anthropic, red team simulated attacks, and regular scans for vulnerabilities across our dependencies, secrets, supply chain, cloud posture, and containers.","Claude plays a large role in these, but we’ll focus on larger changes to our monitoring efforts as a result of our AI-native SDLC: alert triage and code migrations.","When an alert fires at Anthropic, Claude starts:","What this agent can’t do is deploy the fix automatically. It’s a single-purpose system account agent with three permissions: it can write new docs, post in company channels, and access production logs.","The fix either needs to come from a separate agent-human reviewer system. The reason for this comes back to managing identity, permissions, and hard boundaries: it’s important to contain the blast radius when pushing code into production. Separating agents is critical as one (or multiple) agents act as checks on the other.","This is also an important lesson for CISOs, and one that I had to learn the hard way. When considering an agent’s hard boundaries you need to include its access to other agents.","Following a model upgrade, the incident response agent reached out over Slack to another Claude instance on its own initiative. It asked the agent, which could write code, to push the fix. This was caught at a human review gate as designed , but this experience taught us to draw the boundary around access and actions, not around a model’s instructions or what we believe a model can do. Today at Anthropic, agent-to-agent communication on Slack is the norm and we give considerable thought to agent identity models：https://claude.com/blog/agent-identity-access-model.","The second major change is how our team approaches migrations. Every security engineering team has experienced the moment where they realize a code migration will be necessary to fix some systemic flaw in the way the company operates. In the past, the CISO would need to start campaigning and request a small percentage of each department’s engineering resources for multiple quarters to get it fixed.","The economic cost of migration has fallen and so too has the cost of cross company coordination. Claude automates the migration process, tens of thousands of lines of code, in days：https://claude.com/blog/ai-code-migration.","Enduring Principle : Give every agent a single-purpose identity with the minimum permissions for its job. If you do let agents coordinate, have them do so over the same channels as humans."],"articleImages":[{"sourceUrl":"https://cdn.prod.website-files.com/68a44d4040f98a4adf2207b6/6903d22824d4124c2e33ba8e_b1ce510c468b2920d4f8f61c17a50906801f939a-1000x1000.svg","alt":"","afterParagraph":0,"url":"/media/articles/cmruye3wf00qubinv8iptndu9/2e542e49eeb40955.jpg"},{"sourceUrl":"https://cdn.prod.website-files.com/68a44d4040f98a4adf2207b6/6a5fa5786cc9f557247c1256_9c126d9d.png","alt":"","afterParagraph":9,"url":"/media/articles/cmruye3wf00qubinv8iptndu9/f24e73bfa5a946fa.png"},{"sourceUrl":"https://cdn.prod.website-files.com/68a44d4040f98a4adf2207b6/6a5fa80d84f25c4ed3f5421f_three-steps-diagram.png","alt":"","afterParagraph":14,"url":"/media/articles/cmruye3wf00qubinv8iptndu9/ec08d2a10502ef2c.png"},{"sourceUrl":"https://cdn.prod.website-files.com/68a44d4040f98a4adf2207b6/6a5fa78b8f99d4eea5c0c389_closed-loop-diagram.png","alt":"","afterParagraph":21,"url":"/media/articles/cmruye3wf00qubinv8iptndu9/ffc1b9a2dfc6e0ce.png"},{"sourceUrl":"https://cdn.prod.website-files.com/68a44d4040f98a4adf2207b6/6a5faaaf38e56da47cb6564d_permission-boundary-diagram.png","alt":"","afterParagraph":54,"url":"/media/articles/cmruye3wf00qubinv8iptndu9/afde36acd77028b8.png"}],"mediaStatus":"ok","articleBodyZh":["Anthropic 副首席信息安全官 Jason Clinton 详细介绍了安全工程团队如何保护一个 80% 合并代码由 AI 撰写的 SDLC。","在 Anthropic，代码量和部署速度呈指数增长。我们的软件工程师平均每季度发布的代码量是 2021 年至 2025 年的 8 倍。","我们的审查、监控和其他安全流程需要随着这种加快的速度进行扩展。否则，这将成为瓶颈的公式（Amdahl 定律：https://en.wikipedia.org/wiki/Amdahl%27s_law）。","我们的软件开发流程也发生了巨大变化。Claude 已从编码助手发展为主要创作者和审查者。Claude 撰写：https://www.anthropic.com/institute/recursive-self-improvement 目前约 80% 合并到我们代码库中的代码。","超过一半的代码由我们内部版本的 Claude Tag 合并：https://www.anthropic.com/news/introducing-claude-tag，而人类工程师专注于指导、设定意图并拥有最终批准权。","这意味着我们的安全团队必须防御快速扩张的攻击面，并强化以非确定性、不断演化的代理为核心的生命周期。在本文中，我将介绍保护软件开发生命周期（SDLC）的策略。","（本文旨在与我们最近发布的零信任代理框架：https://claude.com/blog/zero-trust-for-ai-agents 结合使用；本文中所有内容在实施上都使用了该框架的安全设计理念）。","我们设计应对的威胁是具体的：被攻破或被提示注入的代理可能引入恶意更改；供应链和依赖被污染，代理将其作为可信输入摄取；以及现在以更高频率出现的更常见应用程序漏洞类别。下面的每一个控制措施至少对应上述一种威胁。","我们部署了几种总体策略，以实现这一目标，同时不会显著降低开发速度，包括：","在这篇文章中，我们将介绍在软件开发生命周期特定阶段中实施的安全流程，以及其背后的核心原则。这些原则具有更持久的价值，因为随着模型能力的演进，安全团队必须重新审视并经常重新设计其流程。","我们的开发团队已经详细介绍了他们对软件开发生命周期所做的更改：https://claude.com/blog/running-an-ai-native-engineering-org，所以在深入每个阶段之前，这里将做一个简要的概述。","从宏观上来看，我们的软件开发生命周期是压缩的。它更多由原型和内部采用（自家试用）驱动，而不是长时间的计划周期。创意来自组织的各个角落，传统角色（前端、后端、设计）界限模糊。审查和批准仍然有人工参与，但也由智能循环驱动。","虽然每个阶段都被Claude Code和Claude Tag从根本上转变并加速了，但每个阶段的名称和目的对于来自更传统组织的开发者来说并不陌生。这些是自然的关卡，我们也将其用作AI原生软件开发生命周期的安全流程的一部分。","我们最早的安全自动化之一是一个由Claude Opus驱动的简单的PSR（项目安全评审）网页应用。它会接收项目设计文档，并根据MITRE ATT&CK框架：https://attack.mitre.org/ 分析文档，以识别潜在漏洞并提出缓解建议。","通过将其连接到内部知识索引，我们显著增强了系统，提供了整个组织范围内的政策、过去的决策和相关系统的更深层次背景。","这让我们更好地了解潜在风险，并且还捕获了PSR中缺失的信息。这一实现节省了大多数应用安全团队的时间。一旦我们对Claude在风险评估中的准确性有信心，如果Claude认为项目启动风险较低，我们就允许团队自行批准项目。","这里我们可以看到AI原生软件开发生命周期的首个关键适应。PSR最初是为了在漫长且昂贵的编码过程之前发现安全问题而设计的。在这一阶段捕捉到问题可以节省数月的重新开发时间。","今天，多个主要功能的原型可以在数小时内创建，使得详细的架构审查不再是关键障碍。将我们的 PSR 应用程序连接到知识索引，可以捕捉到在其他情况下可能会被忽略的上下文，而不会制造不必要的速度障碍。创建 Claude Code 技能使 Claude 能够进一步扩展并捕捉其所在位置的额外上下文。","持久原则：将安全代理连接到组织上下文。随着规划周期的压缩，更有效的方法是将这些代理带到上下文已经存在的地方——聊天线程、先前的审查、代码库——而不是在可能不再需要的阶段强制进行详细文档记录。无论哪种方式，代理都需要代码之外的上下文。","在 AI 原生工程组织中，安全专业人员拥有一个新的杠杆：他们可以直接影响代码的创建方式，从源头上帮助防止漏洞。","此前，团队观察到重复出现的漏洞，并制定安全编码指南以加以解决，但这些指南难以强制执行且很少标准化。","在 Anthropic，这些指南被编码在 CLAUDE.md 文件中，并引用组织范围的技能，因此代码在生成的瞬间就会遵循这些最佳实践。这是闭环流程的一部分。一旦代理发现某类漏洞，相关文件就会被更新，以防止其在未来的代码中再次出现。","当然，这并不意味着所有代码都是完美的。我们的团队从一个 CLAUDE.md 文件开始，该文件指示代理在打开 PR 之前运行 /security-review：https://support.claude.com/en/articles/11932705-automated-security-reviews-in-claude-code 作为最后一步。这个广泛可用的命令是我们团队内部审查工作流程的产品化版本，它会查找潜在攻击者可控输入的地方，扫描可疑链接，然后验证其发现。","如今，这些审查在 Claude 生成代码的同时进行。一旦安装了安全指导插件：https://code.claude.com/docs/en/security-guidance，Claude 就会在生成代码的过程中审查对话和代码。它会在生成代码的同一会话中提出安全改进建议并处理常见漏洞。","在 PR 阶段的其他推动措施，会促使内部非技术团队将他们的应用托管在我们的低代码应用托管平台上，从而避免传统上困扰安全团队的影子 IT 问题。","我们的一些客户选择将 /security-review：https://support.claude.com/en/articles/11932705-automated-security-reviews-in-claude-code 与 PreToolUse 钩子集成，这使得这一步骤成为更严格的门槛。这也很有效，但我们的团队选择将严格的代码审查门槛纳入循环的测试/CI 阶段。","除了塑造和审查代码之外，限制潜在影响范围是我们在这一阶段的主要关注点之一。我们通过在身份上设置严格边界（在监控部分会详细说明）以及让开发者在虚拟机上进行编码来实现这一点。","将我们的编码迁移到远程虚拟机是一种相对轻松的转变，并且相比仅使用笔记本电脑，我们获得了更高的控制力和可见性。这些虚拟机上的代理流量是经过出站白名单控制的。","这些严格的出站控制尤其重要，当代理正在读取可能携带提示注入负载的不受信输入时。注入的指令无法到达互联网中的任意目标：外泄路径仅限于一小部分受监控的服务。","在这里，你可以再次看到对 AI 原生软件开发生命周期的明确适应。以前远程编码主要用于保护知识产权，而今天我们看到更成熟的 AI 编码团队采用这些环境作为限制代理的手段。","持久原则：在 AI 原生工程组织中向左转意味着闭合漏洞发现与更新指令之间的循环，以定制 Claude 的代码生成方式。根据需要限制潜在影响范围（最小代理原则）以及代理能访问的内容，并设置严格边界。","根据我的经验，在 AI 原生转型过程中，测试或 CI 阶段很快就会成为工程团队最痛苦的瓶颈。在 Anthropic，一旦大多数开发者开始使用代理式编码工具并同时运行多个代理，团队速度很快就明显受限于人工审查代码的速度。","让我们明确一点：人工责任仍然是我们流程的核心。我们所做的是通过结合自动化的代理审查和确定性审查来加速审查流程，同时将人工审查保留给受监管或真正关键的代码。","从历史上看，人工代码审查一直被认为是标准，但实证证据：https://link.springer.com/chapter/10.1007/978-3-642-36563-8_14 已显示其并不完美。全球的软件中经常出现安全漏洞。我们的审查流程能够审查更多代码并发现特别复杂的问题，从而有助于降低这些风险。","获得实质性审查意见的PR比例已从16%增长到54%：https://claude.com/blog/code-review，随着我们要求代理提供其发现有效的证明，我们对审查结果的信心也增加了。我们还确定，过去claude.ai事件背后大约三分之一的漏洞，本可以通过我们现在实施的自动化流程被发现：https://www.anthropic.com/institute/recursive-self-improvement。","我们并不是唯一发现这一点的组织。Intercom分享道：https://www.intercom.com/blog/ai-is-approving-our-pull-requests-heres-how-we-made-it-safe/ 它自动批准了19%的PR。部署次数翻倍，而因破坏性代码变更导致的停机时间减少了35%。CircleCI在构建Chunk时得出了类似结论，这是一款基于Claude的自主代理，解决CI/CD维护问题并在人工看到之前验证自身修复。该：https://claude.com/customers/circleci 方法将代理任务转化为完成的PR的速度翻倍。","在Anthropic打开PR时，多个代理会自动进行审查。每个审查代理都有特定的、狭窄的关注范围，并利用RAG获取额外的上下文信息和过往事件的记忆。","这比使用一个超大提示或超级安全代理更有效，原因有几个：","需要明确的是，代理不会不加检查地将代码合并到生产环境。我们按风险将代码库分层，并对自动化的部分做出慎重决策。整个代码库都有严格的人工审批流程。","人工责任仍然是由 Claude 审查和合并的代码的核心。每一次批准都会记录其背后的信号和推理，并且会有人对具有风险权重的样本进行复核。另一轮测试关注不变量，例如“用户 A 永远不能读取用户 B 的数据”，并触发额外的人工审查。我们还将代理扫描与 SAST 工具结合使用，这些工具会直接在 PR 上发布结果。","大多数扫描方法，无论是代理式还是确定性方法，都是基于消耗的。随着代码吞吐量的增加，成本也将增加，团队需要决定适合他们的覆盖水平。","在 Anthropic，我们接受随着代码速度增加成本会增长，但预计单位成本会下降。当前的模型在编程方面远胜几年前的所有模型，我们预计这种趋势将会继续。","持久原则：自动化审查是一种不同类型的风险，需要通过不同的方式控制（通过多个关卡和具有独立上下文窗口的代理）。人类仍然在循环中，但在生命周期中的位置可能因代码库的性质而不同。","Anthropic 保持了稳健的分阶段环境，在那里我们执行常见的安全最佳实践，例如重大发布时进行外部渗透测试，以及定期进行 DAST 扫描，以捕捉静态扫描未发现或无法发现的逻辑漏洞。","像其他软件开发生命周期阶段一样，AI 给安全团队带来了新的挑战和解决方案。一方面，较少的漏洞会到达这一阶段。另一方面，幸存的漏洞往往是最微妙且最难发现的。","再加上更大量的代码更频繁地发布，定期的动态测试似乎也不再那么动态。","好消息是，AI 模型在多步骤、跨组件推理方面表现更好，可以捕获更高比例的复杂漏洞。例如，在二月份，我们披露 Claude 发现并帮助修复了超过 500 个高严重性开源漏洞：https://www.anthropic.com/research/zero-days。","在Anthropic，我们正在我们的测试环境中实施持续的AI驱动的动态应用安全测试（DAST）扫描。这些扫描会查找系统级的漏洞，即两个或多个服务之间假设不正确的情况。今天有许多供应商提供这些功能。","持久原则：动态测试应与部署节奏相匹配。","任何优秀的安全团队都知道，一旦代码推送到生产环境，工作并未结束。我们可以假设任何漏洞都会被日益复杂的攻击者迅速发现。","我们的安全团队在这里实施了一些标准做法，例如公开的漏洞悬赏计划：https://hackerone.com/anthropic、红队模拟攻击，以及对我们的依赖项、密钥、供应链、云安全状态和容器进行定期漏洞扫描。","Claude在这些过程中扮演了重要角色，但我们将重点关注由于我们的AI原生软件开发生命周期（SDLC）而对监控工作所做的更大改进：警报分类和代码迁移。","当Anthropic触发警报时，Claude会开始行动：","这个代理无法自动部署修复。它是一个单一用途的系统账户代理，具有三项权限：可以撰写新文档、在公司频道发布信息，以及访问生产日志。","修复必须由另一个代理-人工审查系统提供。原因归结于身份、权限和严格边界的管理：在将代码推送到生产环境时，控制影响范围非常重要。分离代理至关重要，因为一个（或多个）代理对另一个代理起到检查作用。","这对于首席信息安全官（CISO）也是一个重要的经验教训，而这是我不得不通过教训学会的。在考虑代理的严格边界时，需要包括其对其他代理的访问权限。","在模型升级之后，事件响应代理主动通过 Slack 联系了另一个 Claude 实例。它让能够编写代码的代理去推进修复。这在设计时被设置为在人工审核环节被捕捉，但这次经历教会了我们应当在访问和操作上划定边界，而不是围绕模型的指令或我们认为模型能做的事情来划定。今天在 Anthropic，代理之间在 Slack 上的通信是常态，我们还会非常认真地考虑代理身份模型：https://claude.com/blog/agent-identity-access-model。","第二个重大变化是我们团队处理迁移的方式。每个安全工程团队都会经历这样一个时刻：他们意识到代码迁移是必要的，以修复公司运营方式中的某些系统性缺陷。过去，首席信息安全官（CISO）需要开始推动，并在多个季度请求每个部门一小部分工程资源来完成修复。","迁移的经济成本已经下降，跨公司协调的成本也随之降低。Claude 将迁移过程（数万行代码）在几天内自动化完成：https://claude.com/blog/ai-code-migration。","持久原则：为每个代理赋予单一目的身份，并仅提供其工作所需的最小权限。如果确实让代理进行协调，应让它们通过与人类相同的渠道进行交流。"],"translationStatus":"translated","bodyOrigin":"source-page","editorial":{"summary":"Anthropic披露，工程师每季度交付代码量达到2021至2025年平均水平的8倍，约80%的合并代码由Claude编写。其安全体系同步扩展审查、监控和其他流程，以适应更高的代码产出与部署速度。","background":"Claude已从编码助手演变为主要的代码创建者和审查者；超过一半代码通过内部版Claude Tag合并，人类工程师负责方向、意图设定与最终批准。软件生命周期因此以非确定且持续演进的智能体为核心。","viewpoint":"Aioga判断，这一案例的重点并非单纯提高编码效率，而是让安全控制随交付规模同步扩展。智能体承担更多创建与审查工作后，人类最终批准、身份与访问边界以及关键节点审核更值得关注。","implications":"材料明确列出的威胁包括：被入侵或遭提示注入的智能体提交恶意变更、智能体把受污染的供应链与依赖项当作可信输入，以及常见应用漏洞以更高数量进入开发流程。","nextStep":"Aioga判断，采用AI原生开发流程的团队可优先核查每项安全控制能否对应具体威胁，并评估审查、监控、身份访问边界、自动化检查与人工最终批准是否能够随代码交付速度同步扩展。","evidenceRefs":["title","summary","articleBody","source"],"status":"published","aiGenerated":true,"autoApproved":true,"generatedBy":"aioga-editorial:gpt-5.6-sol","reviewedBy":"aioga-editorial-review:gpt-5.6-sol","generatedAt":"2026-07-23T02:10:04.223Z","sourceHash":"40befb06251dd636","review":{"approved":true,"groundedness":94,"clarity":90,"duplicationRisk":38,"blockingIssues":[],"notes":["“工程师每季度交付代码量达到2021至2025年平均水平的8倍”与来源摘要一致，但英文摘录原句的比较基准略显含糊；若追求更严谨，可改为“工程师平均每季度交付的代码量增至2021—2025年间基准水平的8倍”。","viewpoint与nextStep均强调安全控制随交付规模同步扩展，存在轻微语义重复，但未达到阻断程度。","“Aioga判断”清楚标识了观点和建议，未将其冒充来源事实。"]},"validation":{"passed":true,"mode":"ai-auto","revisions":0,"checks":["schema","length","source-attribution","low-source-overlap","no-html","independent-ai-review"]}},"tags":["技巧观点","Claude：Blog（网页）"],"translations":{"zh-CN":{"title":"Anthropic 如何保障AI原生软件开发生命周期的安全","summary":"Anthropic副首席信息安全官Jason Clinton披露，其软件工程师每季度交付的代码量是2021-2025年平均水平的8倍，Claude编写了约80%合并入库的代码。安全团队通过安全左移、硬访问与身份边界、自动化与智能体审查结合、关键节点引入人工审核等策略，应对被入侵或提示注入的智能体引入恶意变更等威胁，同时不显著拖慢开发速度。","category":"技巧观点","source":"Claude：Blog（网页）","aggregationSource":"Claude：Blog（网页）","pageTitle":"Anthropic 如何保障AI原生软件开发生命周期的安全 - Aioga AI资讯","description":"Anthropic副首席信息安全官Jason Clinton披露，其软件工程师每季度交付的代码量是2021-2025年平均水平的8倍，Claude编写了约80%合并入库的代码。安全团队通过安全左移、硬访问与身份边界、自动化与智能体审查结合、关键节点引入人工审核等策略，应对被入侵或提示注入的智能体引入恶意变更等威胁，同时不显著拖慢开发速度。","url":"https://www.aioga.com/news/cmruye3wf00qubinv8iptndu9/"},"en":{"title":"How Anthropic ensures the security of the AI native software development lifecycle","summary":"Anthropic's Deputy Chief Information Security Officer Jason Clinton revealed that the amount of code delivered by its software engineers each quarter is eight times the average level from 2021 to 2025, and Claude wrote about 80% of the code merged into the repository. The security team addresses threats such as agents introducing malicious changes due to being compromised or prompt injections through strategies like shifting security to the left, hard access and identity boundaries, combining automation with agent review, and introducing manual checks at critical points, while not significantly slowing down development speed.","category":"Insights","source":"Claude：Blog（网页）","aggregationSource":"Claude：Blog（网页）","pageTitle":"How Anthropic ensures the security of the AI native software development lifecycle - Aioga AI News","description":"Anthropic's Deputy Chief Information Security Officer Jason Clinton revealed that the amount of code delivered by its software engineers each quarter is eight times the average lev...","url":"https://www.aioga.com/en/news/cmruye3wf00qubinv8iptndu9/","contentTranslated":true,"sourceHash":"0b2983457261cafc","translatedAt":"2026-07-22T17:25:14.142Z"},"ja":{"title":"Anthropic はどのようにして AI ネイティブソフトウェアの開発ライフサイクルの安全を保障するのか","summary":"Anthropicの副最高情報セキュリティ責任者ジェイソン・クリントンは、同社のソフトウェアエンジニアが四半期ごとに納品するコード量は2021年から2025年の平均水準の8倍であり、Claudeがマージされたコードの約80％を作成したと明かした。セキュリティチームは、セキュリティの早期導入、厳格なアクセスとID境界、オートメーションとエージェントによるレビューの組み合わせ、重要なノードでの手動レビュー導入といった戦略を通じて、侵入されたエージェントやプロンプト注入によって導入される悪意ある変更などの脅威に対処しつつ、開発速度を大幅に遅らせることはない。","category":"ヒントと視点","source":"Claude：Blog（网页）","aggregationSource":"Claude：Blog（网页）","pageTitle":"Anthropic はどのようにして AI ネイティブソフトウェアの開発ライフサイクルの安全を保障するのか - Aioga AIニュース","description":"Anthropicの副最高情報セキュリティ責任者ジェイソン・クリントンは、同社のソフトウェアエンジニアが四半期ごとに納品するコード量は2021年から2025年の平均水準の8倍であり、Claudeがマージされたコードの約80％を作成したと明かした。セキュリティチームは、セキュリティの早期導入、厳格なアクセスとID境界、オートメーションとエージェントによるレビュ...","url":"https://www.aioga.com/ja/news/cmruye3wf00qubinv8iptndu9/","contentTranslated":true,"sourceHash":"0b2983457261cafc","translatedAt":"2026-07-22T17:25:34.175Z"},"ko":{"title":"Anthropic가 AI 원생 소프트웨어 개발 수명 주기의 안전을 어떻게 보장하는가","summary":"Anthropic 부수석 정보보안관 Jason Clinton은 소프트웨어 엔지니어들이 분기마다 제출하는 코드 양이 2021-2025년 평균 수준의 8배에 달하며, Claude가 병합되어 저장소에 들어가는 코드의 약 80%를 작성했다고 공개했다. 보안팀은 보안 초기 단계 반영, 엄격한 접근 및 신원 경계, 자동화와 에이전트 검토 결합, 주요 노드에 인간 검토 도입 등의 전략을 통해 침입되거나 프롬프트 주입된 에이전트가 악의적 변경을 도입하는 위협에 대응하면서도 개발 속도를 현저히 늦추지 않는다.","category":"인사이트","source":"Claude：Blog（网页）","aggregationSource":"Claude：Blog（网页）","pageTitle":"Anthropic가 AI 원생 소프트웨어 개발 수명 주기의 안전을 어떻게 보장하는가 - Aioga AI 뉴스","description":"Anthropic 부수석 정보보안관 Jason Clinton은 소프트웨어 엔지니어들이 분기마다 제출하는 코드 양이 2021-2025년 평균 수준의 8배에 달하며, Claude가 병합되어 저장소에 들어가는 코드의 약 80%를 작성했다고 공개했다. 보안팀은 보안 초기 단계 반영, 엄격한 접근 및 신원 경계, 자동화와 에이전트...","url":"https://www.aioga.com/ko/news/cmruye3wf00qubinv8iptndu9/","contentTranslated":true,"sourceHash":"0b2983457261cafc","translatedAt":"2026-07-22T17:26:18.916Z"},"es":{"title":"Cómo Anthropic garantiza la seguridad del ciclo de vida de desarrollo de software nativo de IA","summary":"El subdirector de seguridad de la información de Anthropic, Jason Clinton, reveló que la cantidad de código que sus ingenieros de software entregan cada trimestre es 8 veces el promedio de 2021-2025, y Claude escribió aproximadamente el 80% del código que se fusionó en el repositorio. El equipo de seguridad, mediante estrategias como el desplazamiento de seguridad hacia la izquierda, el acceso estrictamente controlado y los límites de identidad, la combinación de automatización y revisión por agentes inteligentes, y la introducción de revisiones humanas en nodos clave, aborda amenazas como la introducción de cambios maliciosos por agentes invadidos o inyecciones de indicaciones, sin ralentizar significativamente la velocidad de desarrollo.","category":"Ideas","source":"Claude：Blog（网页）","aggregationSource":"Claude：Blog（网页）","pageTitle":"Cómo Anthropic garantiza la seguridad del ciclo de vida de desarrollo de software nativo de IA - Aioga Noticias de IA","description":"El subdirector de seguridad de la información de Anthropic, Jason Clinton, reveló que la cantidad de código que sus ingenieros de software entregan cada trimestre es 8 veces el pro...","url":"https://www.aioga.com/es/news/cmruye3wf00qubinv8iptndu9/","contentTranslated":true,"sourceHash":"0b2983457261cafc","translatedAt":"2026-07-22T17:26:15.635Z"},"fr":{"title":"Comment Anthropic assure la sécurité du cycle de vie du développement logiciel natif de l'IA","summary":"Le vice-directeur de la sécurité de l'information d'Anthropic, Jason Clinton, a révélé que la quantité de code livrée chaque trimestre par ses ingénieurs logiciels est huit fois supérieure à la moyenne de 2021-2025, et que Claude a écrit environ 80 % du code fusionné dans le dépôt. L'équipe de sécurité utilise des stratégies telles que le déplacement précoce de la sécurité, des frontières strictes d'accès et d'identité, une combinaison d'automatisation et de révision par des agents intelligents, et l'introduction de révisions humaines aux points critiques, afin de faire face aux menaces telles que des modifications malveillantes introduites par des agents infiltrés ou des injections de prompts, tout en ne ralentissant pas de manière significative la vitesse de développement.","category":"Analyses","source":"Claude：Blog（网页）","aggregationSource":"Claude：Blog（网页）","pageTitle":"Comment Anthropic assure la sécurité du cycle de vie du développement logiciel natif de l'IA - Aioga Actualités IA","description":"Le vice-directeur de la sécurité de l'information d'Anthropic, Jason Clinton, a révélé que la quantité de code livrée chaque trimestre par ses ingénieurs logiciels est huit fois su...","url":"https://www.aioga.com/fr/news/cmruye3wf00qubinv8iptndu9/","contentTranslated":true,"sourceHash":"0b2983457261cafc","translatedAt":"2026-07-22T17:27:08.477Z"},"de":{"title":"Wie Anthropic die Sicherheit des Entwicklungslebenszyklus von KI-nativer Software gewährleistet","summary":"Anthropic-Vize-CISO Jason Clinton gab bekannt, dass die von seinen Softwareingenieuren pro Quartal gelieferten Code-Mengen das Achtfache des Durchschnitts von 2021 bis 2025 betragen, wobei Claude etwa 80 % des in das Repository zusammengeführten Codes geschrieben hat. Das Sicherheitsteam begegnet Bedrohungen wie böswilligen Änderungen durch kompromittierte oder prompt-injizierte Agenten durch Strategien wie Shift-Left-Sicherheit, strikte Zugriffs- und Identitätsgrenzen, Kombination aus Automatisierung und Agentenüberprüfung sowie manuelle Überprüfungen an kritischen Punkten, ohne dabei die Entwicklungsgeschwindigkeit erheblich zu verlangsamen.","category":"技巧观点","source":"Claude：Blog（网页）","aggregationSource":"Claude：Blog（网页）","pageTitle":"Wie Anthropic die Sicherheit des Entwicklungslebenszyklus von KI-nativer Software gewährleistet - Aioga KI-News","description":"Anthropic-Vize-CISO Jason Clinton gab bekannt, dass die von seinen Softwareingenieuren pro Quartal gelieferten Code-Mengen das Achtfache des Durchschnitts von 2021 bis 2025 betrage...","url":"https://www.aioga.com/de/news/cmruye3wf00qubinv8iptndu9/","contentTranslated":true,"sourceHash":"0b2983457261cafc","translatedAt":"2026-07-22T17:27:00.487Z"},"pt-BR":{"title":"Como a Anthropic garante a segurança do ciclo de vida do desenvolvimento de software nativo de IA","summary":"Jason Clinton, vice-diretor de segurança da informação da Anthropic, revelou que a quantidade de código entregue por seus engenheiros de software a cada trimestre é 8 vezes a média de 2021-2025, e Claude escreveu cerca de 80% do código que foi incorporado ao repositório. A equipe de segurança enfrenta ameaças como agentes comprometidos ou instruções maliciosas introduzindo alterações maliciosas, por meio de estratégias como segurança antecipada, limites rígidos de acesso e identidade, automação combinada com revisão de agentes inteligentes, e introdução de revisão humana em pontos críticos, ao mesmo tempo em que não desacelera significativamente a velocidade de desenvolvimento.","category":"技巧观点","source":"Claude：Blog（网页）","aggregationSource":"Claude：Blog（网页）","pageTitle":"Como a Anthropic garante a segurança do ciclo de vida do desenvolvimento de software nativo de IA - Aioga Notícias de IA","description":"Jason Clinton, vice-diretor de segurança da informação da Anthropic, revelou que a quantidade de código entregue por seus engenheiros de software a cada trimestre é 8 vezes a média...","url":"https://www.aioga.com/pt-BR/news/cmruye3wf00qubinv8iptndu9/","contentTranslated":true,"sourceHash":"0b2983457261cafc","translatedAt":"2026-07-22T17:27:50.340Z"},"ru":{"title":"Как Anthropic обеспечивает безопасность жизненного цикла разработки программного обеспечения для ИИ","summary":"Заместитель главного директора по информационной безопасности Anthropic Джейсон Клинтон сообщил, что объем кода, который их инженеры-программисты сдают каждый квартал, в 8 раз превышает средний уровень 2021–2025 годов, а Клод написал около 80% кода, включенного в основную базу. Команда безопасности использует стратегии, такие как сдвиг безопасности влево, жесткие правила доступа и границы идентификации, сочетание автоматизации и проверок агентами, а также привлечение ручной проверки на ключевых этапах, чтобы справляться с угрозами, связанными с вредоносными изменениями, введенными агентами через взлом или инъекцию подсказок, при этом не замедляя существенно скорость разработки.","category":"技巧观点","source":"Claude：Blog（网页）","aggregationSource":"Claude：Blog（网页）","pageTitle":"Как Anthropic обеспечивает безопасность жизненного цикла разработки программного обеспечения для ИИ - Aioga Новости ИИ","description":"Заместитель главного директора по информационной безопасности Anthropic Джейсон Клинтон сообщил, что объем кода, который их инженеры-программисты сдают каждый квартал, в 8 раз прев...","url":"https://www.aioga.com/ru/news/cmruye3wf00qubinv8iptndu9/","contentTranslated":true,"sourceHash":"0b2983457261cafc","translatedAt":"2026-07-22T17:27:56.105Z"},"ar":{"title":"كيف تضمن Anthropic أمان دورة حياة تطوير البرمجيات الأصلية للذكاء الاصطناعي","summary":"كشف جيسون كلينتون، نائب رئيس أمن المعلومات في أنثروبيك، أن كمية الشيفرة التي يسلمها مهندسو البرمجيات لديهم كل ربع سنة تبلغ ثمانية أضعاف المتوسط بين 2021-2025، وأن كلود كتب حوالي 80% من الشيفرة المدمجة في المستودع. يواجه فريق الأمن التهديدات مثل إدخال التغييرات الخبيثة عبر العملاء الذكيين الذين تم اختراقهم أو تم حقنهم بالتعليمات، من خلال استراتيجيات تشمل نقل الأمن إلى اليسار، الوصول الصارم وقيود الهوية، الجمع بين المراجعة الآلية ووكيل الذكاء، وتقديم المراجعة اليدوية في النقاط الرئيسية، دون إبطاء كبير في سرعة التطوير.","category":"技巧观点","source":"Claude：Blog（网页）","aggregationSource":"Claude：Blog（网页）","pageTitle":"كيف تضمن Anthropic أمان دورة حياة تطوير البرمجيات الأصلية للذكاء الاصطناعي - Aioga أخبار الذكاء الاصطناعي","description":"كشف جيسون كلينتون، نائب رئيس أمن المعلومات في أنثروبيك، أن كمية الشيفرة التي يسلمها مهندسو البرمجيات لديهم كل ربع سنة تبلغ ثمانية أضعاف المتوسط بين 2021-2025، وأن كلود كتب حوالي 80...","url":"https://www.aioga.com/ar/news/cmruye3wf00qubinv8iptndu9/","contentTranslated":true,"sourceHash":"0b2983457261cafc","translatedAt":"2026-07-22T17:28:43.219Z"},"hi":{"title":"Anthropic कैसे AI मूल सॉफ़्टवेयर विकास जीवनचक्र की सुरक्षा सुनिश्चित करता है","summary":"Anthropic के उपमुख्य सूचना सुरक्षा अधिकारी Jason Clinton ने खुलासा किया कि उनके सॉफ़्टवेयर इंजीनियर हर तिमाही जो कोड सौंपते हैं, वह 2021-2025 के औसत स्तर का 8 गुना है, और Claude ने लगभग 80% कोड लिखा जो मर्ज होकर रिपॉजिटरी में गया। सुरक्षा टीम ने सुरक्षा को आगे बढ़ाने, कड़े पहुंच और पहचान सीमा, स्वचालन और एजेंट समीक्षा के संयोजन, महत्वपूर्ण बिंदुओं पर मानवीय समीक्षा शामिल करने जैसी रणनीतियों के माध्यम से उन खतरों का सामना किया जो एजेंट द्वारा अपहरण या संकेत इंजेक्शन के जरिए दुर्भावनापूर्ण बदलाव ला सकते हैं, और यह विकास की गति को काफी धीमा नहीं करता।","category":"技巧观点","source":"Claude：Blog（网页）","aggregationSource":"Claude：Blog（网页）","pageTitle":"Anthropic कैसे AI मूल सॉफ़्टवेयर विकास जीवनचक्र की सुरक्षा सुनिश्चित करता है - Aioga AI समाचार","description":"Anthropic के उपमुख्य सूचना सुरक्षा अधिकारी Jason Clinton ने खुलासा किया कि उनके सॉफ़्टवेयर इंजीनियर हर तिमाही जो कोड सौंपते हैं, वह 2021-2025 के औसत स्तर का 8 गुना है, और Claude ने...","url":"https://www.aioga.com/hi/news/cmruye3wf00qubinv8iptndu9/","contentTranslated":true,"sourceHash":"0b2983457261cafc","translatedAt":"2026-07-22T17:28:53.529Z"},"it":{"title":"Come Anthropic garantisce la sicurezza del ciclo di vita dello sviluppo del software nativo per l'IA","summary":"Il vicepresidente e direttore della sicurezza informatica di Anthropic, Jason Clinton, ha rivelato che i suoi ingegneri del software consegnano ogni trimestre una quantità di codice pari a 8 volte la media del periodo 2021-2025, e Claude ha scritto circa l'80% del codice integrato nel repository. Il team di sicurezza affronta minacce come l'introduzione di modifiche dannose da parte di agenti compromessi o tramite prompt injection mediante strategie come lo spostamento della sicurezza a sinistra, l'accesso rigoroso e i confini di identità, la combinazione di revisione automatizzata e da agenti intelligenti, e l'introduzione della revisione manuale nei nodi critici, senza rallentare significativamente la velocità di sviluppo.","category":"技巧观点","source":"Claude：Blog（网页）","aggregationSource":"Claude：Blog（网页）","pageTitle":"Come Anthropic garantisce la sicurezza del ciclo di vita dello sviluppo del software nativo per l'IA - Aioga Notizie IA","description":"Il vicepresidente e direttore della sicurezza informatica di Anthropic, Jason Clinton, ha rivelato che i suoi ingegneri del software consegnano ogni trimestre una quantità di codic...","url":"https://www.aioga.com/it/news/cmruye3wf00qubinv8iptndu9/","contentTranslated":true,"sourceHash":"0b2983457261cafc","translatedAt":"2026-07-22T17:29:48.842Z"},"nl":{"title":"Hoe Anthropic de veiligheid van de levenscyclus van AI-native softwareontwikkeling waarborgt","summary":"De vice-chief information security officer van Anthropic, Jason Clinton, onthulde dat de hoeveelheid code die hun software-ingenieurs elk kwartaal leveren acht keer zo hoog is als het gemiddelde niveau van 2021-2025, en Claude ongeveer 80% van de samengevoegde code heeft geschreven. Het beveiligingsteam gebruikt strategieën zoals security shift-left, strikte toegangs- en identiteitsgrenzen, combinatie van automatisering en agentbeoordeling, en handmatige controles op kritieke knooppunten om bedreigingen zoals door AI geïnjecteerde kwaadaardige veranderingen bij inbraken of promptinjection aan te pakken, terwijl de ontwikkelsnelheid niet significant vertraagd wordt.","category":"技巧观点","source":"Claude：Blog（网页）","aggregationSource":"Claude：Blog（网页）","pageTitle":"Hoe Anthropic de veiligheid van de levenscyclus van AI-native softwareontwikkeling waarborgt - Aioga AI-nieuws","description":"De vice-chief information security officer van Anthropic, Jason Clinton, onthulde dat de hoeveelheid code die hun software-ingenieurs elk kwartaal leveren acht keer zo hoog is als...","url":"https://www.aioga.com/nl/news/cmruye3wf00qubinv8iptndu9/","contentTranslated":true,"sourceHash":"0b2983457261cafc","translatedAt":"2026-07-22T17:29:38.265Z"},"tr":{"title":"Anthropic, AI yerel yazılım geliştirme yaşam döngüsünün güvenliğini nasıl sağlıyor","summary":"Anthropic'in yardımcı baş bilgi güvenliği sorumlusu Jason Clinton, yazılım mühendislerinin her çeyrekte teslim ettiği kod miktarının 2021-2025 ortalamasının 8 katı olduğunu açıkladı; Claude, depoya birleşen kodun yaklaşık %80'ini yazdı. Güvenlik ekibi, güvenliği öne taşıma, sıkı erişim ve kimlik sınırları, otomasyon ve ajan incelemelerini birleştirme, kritik noktalarda insan denetimi uygulama gibi stratejilerle, ele geçirilmiş veya istemli talimat eklemeler yoluyla kötü niyetli değişiklikler yapılması gibi tehditlerle başa çıkarken, geliştirme hızını önemli ölçüde yavaşlatmıyor.","category":"技巧观点","source":"Claude：Blog（网页）","aggregationSource":"Claude：Blog（网页）","pageTitle":"Anthropic, AI yerel yazılım geliştirme yaşam döngüsünün güvenliğini nasıl sağlıyor - Aioga AI Haberleri","description":"Anthropic'in yardımcı baş bilgi güvenliği sorumlusu Jason Clinton, yazılım mühendislerinin her çeyrekte teslim ettiği kod miktarının 2021-2025 ortalamasının 8 katı olduğunu açıklad...","url":"https://www.aioga.com/tr/news/cmruye3wf00qubinv8iptndu9/","contentTranslated":true,"sourceHash":"0b2983457261cafc","translatedAt":"2026-07-22T17:30:44.783Z"},"vi":{"title":"Anthropic làm thế nào để đảm bảo an toàn cho vòng đời phát triển phần mềm AI gốc","summary":"Phó Giám đốc An ninh Thông tin của Anthropic, Jason Clinton, tiết lộ rằng khối lượng mã mà các kỹ sư phần mềm của công ty giao mỗi quý gấp 8 lần mức trung bình trong giai đoạn 2021-2025, Claude viết khoảng 80% mã được hợp nhất vào kho. Nhóm an ninh sử dụng các chiến lược kết hợp chuyển an ninh sang giai đoạn sớm, ranh giới truy cập và nhận diện nghiêm ngặt, đánh giá tự động và bằng tác nhân thông minh, cùng việc đưa vào đánh giá thủ công tại các nút quan trọng, để đối phó với các mối đe dọa như bị xâm nhập hoặc các tác nhân chèn mã độc thông qua gợi ý, đồng thời không làm chậm đáng kể tốc độ phát triển.","category":"技巧观点","source":"Claude：Blog（网页）","aggregationSource":"Claude：Blog（网页）","pageTitle":"Anthropic làm thế nào để đảm bảo an toàn cho vòng đời phát triển phần mềm AI gốc - Tin tức AI Aioga","description":"Phó Giám đốc An ninh Thông tin của Anthropic, Jason Clinton, tiết lộ rằng khối lượng mã mà các kỹ sư phần mềm của công ty giao mỗi quý gấp 8 lần mức trung bình trong giai đoạn 2021...","url":"https://www.aioga.com/vi/news/cmruye3wf00qubinv8iptndu9/","contentTranslated":true,"sourceHash":"0b2983457261cafc","translatedAt":"2026-07-22T17:30:41.463Z"},"id":{"title":"Bagaimana Anthropic menjamin keamanan siklus hidup pengembangan perangkat lunak asli AI","summary":"Wakil Kepala Keamanan Informasi Anthropic, Jason Clinton, mengungkapkan bahwa jumlah kode yang dikirimkan oleh insinyur perangkat lunak setiap kuartal adalah 8 kali rata-rata tingkat 2021-2025, dan Claude menulis sekitar 80% kode yang digabungkan ke dalam repositori. Tim keamanan menghadapi ancaman seperti agen yang disusupi atau disuntikkan prompt yang membawa perubahan berbahaya dengan strategi seperti pergeseran keamanan ke kiri, kontrol akses dan batas identitas yang ketat, kombinasi otomatisasi dan tinjauan agen cerdas, serta pengenalan tinjauan manual pada titik-titik kunci, sambil tidak secara signifikan memperlambat kecepatan pengembangan.","category":"技巧观点","source":"Claude：Blog（网页）","aggregationSource":"Claude：Blog（网页）","pageTitle":"Bagaimana Anthropic menjamin keamanan siklus hidup pengembangan perangkat lunak asli AI - Berita AI Aioga","description":"Wakil Kepala Keamanan Informasi Anthropic, Jason Clinton, mengungkapkan bahwa jumlah kode yang dikirimkan oleh insinyur perangkat lunak setiap kuartal adalah 8 kali rata-rata tingk...","url":"https://www.aioga.com/id/news/cmruye3wf00qubinv8iptndu9/","contentTranslated":true,"sourceHash":"0b2983457261cafc","translatedAt":"2026-07-22T17:31:30.130Z"},"th":{"title":"Anthropic จะรับประกันความปลอดภัยของวงจรชีวิตการพัฒนาซอฟต์แวร์ AI ดั้งเดิมอย่างไร","summary":"รองหัวหน้าฝ่ายความปลอดภัยสารสนเทศของ Anthropic, Jason Clinton เปิดเผยว่า วิศวกรซอฟต์แวร์ของบริษัทสามารถส่งมอบโค้ดได้มากกว่าค่าเฉลี่ยระหว่างปี 2021-2025 ถึง 8 เท่าในแต่ละไตรมาส และ Claude เขียนโค้ดประมาณ 80% ของโค้ดที่ถูกรวมเข้าคลัง ทีมความปลอดภัยรับมือกับภัยคุกคาม เช่น ตัวแทน AI ที่ถูกบุกรุกหรือฝังคำสั่งให้เกิดการเปลี่ยนแปลงที่เป็นอันตราย ด้วยกลยุทธ์เช่น การเลื่อนการตรวจสอบความปลอดภัยไปยังขั้นต้น, การจำกัดการเข้าถึงและขอบเขตตัวตน, การรวมอัตโนมัติและการตรวจสอบโดย AI, และการนำการตรวจสอบด้วยมนุษย์ไปยังจุดสำคัญ พร้อมกันนี้ก็ไม่ทำให้ความเร็วในการพัฒนาช้าลงอย่างมีนัยสำคัญ","category":"技巧观点","source":"Claude：Blog（网页）","aggregationSource":"Claude：Blog（网页）","pageTitle":"Anthropic จะรับประกันความปลอดภัยของวงจรชีวิตการพัฒนาซอฟต์แวร์ AI ดั้งเดิมอย่างไร - ข่าว AI Aioga","description":"รองหัวหน้าฝ่ายความปลอดภัยสารสนเทศของ Anthropic, Jason Clinton เปิดเผยว่า วิศวกรซอฟต์แวร์ของบริษัทสามารถส่งมอบโค้ดได้มากกว่าค่าเฉลี่ยระหว่างปี 2021-2025 ถึง 8 เท่าในแต่ละไตรมาส และ...","url":"https://www.aioga.com/th/news/cmruye3wf00qubinv8iptndu9/","contentTranslated":true,"sourceHash":"0b2983457261cafc","translatedAt":"2026-07-22T17:31:37.259Z"},"pl":{"title":"Jak Anthropic zapewnia bezpieczeństwo cyklu życia oprogramowania natywnego dla AI","summary":"Zastępca dyrektora ds. bezpieczeństwa informacji w Anthropic, Jason Clinton, ujawnił, że ilość kodu dostarczanego kwartalnie przez jego inżynierów oprogramowania jest 8 razy większa niż średni poziom w latach 2021–2025, a Claude napisał około 80% kodu wprowadzonego do repozytorium. Zespół ds. bezpieczeństwa radzi sobie z zagrożeniami, takimi jak wprowadzanie złośliwych zmian przez agentów w wyniku włamań lub wstrzykiwania promptów, stosując strategie takie jak przesunięcie bezpieczeństwa na wcześniejsze etapy (security shift-left), twarde granice dostępu i tożsamości, połączenie automatyzacji z przeglądami agentów oraz wprowadzanie ręcznej kontroli w kluczowych punktach, przy czym nie spowalnia to znacząco tempa rozwoju oprogramowania.","category":"技巧观点","source":"Claude：Blog（网页）","aggregationSource":"Claude：Blog（网页）","pageTitle":"Jak Anthropic zapewnia bezpieczeństwo cyklu życia oprogramowania natywnego dla AI - Aioga Wiadomości AI","description":"Zastępca dyrektora ds. bezpieczeństwa informacji w Anthropic, Jason Clinton, ujawnił, że ilość kodu dostarczanego kwartalnie przez jego inżynierów oprogramowania jest 8 razy większ...","url":"https://www.aioga.com/pl/news/cmruye3wf00qubinv8iptndu9/","contentTranslated":true,"sourceHash":"0b2983457261cafc","translatedAt":"2026-07-22T17:32:23.425Z"}}}}