{ "schemaVersion": "1.0.0", "kind": "editorial-inspection-pack", "provenance": "editorial-guidance", "guideId": "ai-access-and-evidence", "updatedAt": "2026-11-12", "catalogVersion": "0.11.0", "sourceRepository": "https://github.com/sakimyto/security-knowledge", "sourceLicense": "MIT", "catalogHash": "e99906d58134e7e0d33d994548277ae7814000d92c088aa5894c49b62ae60cca", "catalogReviewedAt": "2026-11-09", "execution": "read-only-by-default", "selectedRuleIds": ["SEC-009", "SEC-011"], "deferredRuleIds": [ "SEC-001", "SEC-002", "SEC-003", "SEC-004", "SEC-005", "SEC-006", "SEC-007", "SEC-008", "SEC-010", "SEC-012", "SEC-013", "SEC-014", "SEC-015", "SEC-016" ], "outsideSelectionStatus": "unverified", "resultStatuses": ["finding", "no-finding", "not-applicable", "unverified"], "reportSchemaUrl": "https://sakimyto.com/security-data/report.schema.json", "reportExampleUrl": "https://sakimyto.com/security-data/report.example.json", "catalogDiscoveryUrl": "https://sakimyto.com/security-data/discovery.json", "distributionIndexUrl": "https://sakimyto.com/security-learning-data/index.json", "requiredRuleIndex": [ { "id": "SEC-001", "hash": "efec3489e1663249a2aff75cdb7c25e82d9765acb2bdcfa31e8ee934f12ef626" }, { "id": "SEC-002", "hash": "1398f1a8c28e4441472ef3a0952fde97c4ff19b5010178989f4ddd05b6a193dd" }, { "id": "SEC-003", "hash": "00aa6c368be21452c79e662728102938d7d3896073e53de74ea5fc913250b808" }, { "id": "SEC-004", "hash": "4c8742376f6fe13cb33908f282d1a6af6fd73ae0a13007f8013ca7042fd629b4" }, { "id": "SEC-005", "hash": "695e2e119a1364887732e6ee90c1250d22063f1e6e0ec71746e80b7231ace15f" }, { "id": "SEC-006", "hash": "a3cc524b847c5ec9223ea64ed01920283062fe3fcd0eaf2595bde44f951eed71" }, { "id": "SEC-007", "hash": "154186523c183ea0ec0059b951eb9b35f0ac41557c28df13c071663be3aef6ee" }, { "id": "SEC-008", "hash": "ab2bd7e87128a2ce571578558337ab8577fcda20f841171dba5b45d732ad2f03" }, { "id": "SEC-009", "hash": "8b9d4f314306ca656f73c115c195d84dd803e8a58a53355ed03516b330b26cb2" }, { "id": "SEC-010", "hash": "66b39f4eb8a0f334e98e9388e3f9dab27415e726c0862f0b6a4a4dd10e5e81df" }, { "id": "SEC-011", "hash": "3ae198ddd5fa82a53bcbca648d3a9070b03e3cd5665387e69e50c6bb6d365cb3" }, { "id": "SEC-012", "hash": "2da99baf28980f61385469445d6c000edb5434471a4a3500f1775ca78467824a" }, { "id": "SEC-013", "hash": "630183526a6d030807db345f6214176c12ca911fb261bde3abebc1c355a21d98" }, { "id": "SEC-014", "hash": "d9142da38fbe305f72d506a6d6c3c97f658fa446587dc9b27657622c880c1163" }, { "id": "SEC-015", "hash": "1dfd83077658a79d47897d199f646eb9f69aa4d92c7646c57f2b82a715fde44c" }, { "id": "SEC-016", "hash": "cce435bbacb6fef88c9e9d661222b081d8463e4f025448a7796cdcddd7548488" } ], "boundary": { "ja": "選択した2ルールだけを、許可された対象で読み取り点検します。残る14ルールは実行せず、既存の結果形式へunverifiedと範囲外の理由を残します。資料を読むだけで合格にせず、秘密の実値・変更・外部送信の権限は増やしません。", "en": "Inspect only the two selected rules in authorized scope, read-only. Leave the other fourteen unperformed and report them as unverified with an out-of-scope reason under the existing contract. Reading guidance is not a pass and grants no authority to expose secrets, modify systems, or send data." }, "guide": { "id": "ai-access-and-evidence", "title": { "ja": "AIへ任せる前に、権限と記録を整える", "en": "Set AI boundaries before delegating a task" }, "lead": { "ja": "接続先・操作の許可・追跡できる記録を、実行する側から確認します。", "en": "Review destinations, action authorization, and traceable records at the execution boundary." }, "situation": { "ja": "AIが外部資料を読み、ツールやサービスへ接続して作業するとき。", "en": "Use this when an AI reads external material and uses connected tools or services." }, "goal": { "ja": "何を許可し、何を実際に調べ、何がまだ分からないかを分けて残します。", "en": "Separate authorized actions, actual inspection evidence, and what remains unknown." }, "ruleIds": ["SEC-009", "SEC-011"], "incidentIds": ["aflac-japan-2026", "anthropic-cyber-evals-2026"], "termIds": ["tool-permission", "audit-log", "secret"], "sourceIds": ["ai-agent", "logging"], "steps": [ { "title": { "ja": "点検範囲を先に決める", "en": "Define inspection scope first" }, "action": { "ja": "対象・読み取る資料・利用するツールを選び、変更や外部送信を許可した範囲と分けます。", "en": "Choose targets, readable material, and tools, separately from authorization for changes or external transfers." }, "evidence": { "ja": "対象、許可した操作、資料不足で未確認となる範囲。", "en": "Targets, authorized operations, and scope unverified due to missing material." } }, { "title": { "ja": "実行する側の制限を読む", "en": "Review execution-side enforcement" }, "action": { "ja": "外部の文章が接続先や権限を増やさず、実行側でも対象と操作を検証する仕組みを確認します。", "en": "Review whether the executor validates targets and operations without treating external text as permission." }, "evidence": { "ja": "ツール定義と実行時の確認箇所、対応する既存テスト。", "en": "Tool definitions, execution checks, and corresponding existing tests." } }, { "title": { "ja": "観測と結論を分けて残す", "en": "Separate observations from conclusions" }, "action": { "ja": "秘密の値を含めず、実際に確認した範囲と根拠、未実施の点検を記録します。", "en": "Record inspected scope, evidence, and unperformed checks without including secret values." }, "evidence": { "ja": "対象・操作・結果を追える記録と、各結論の証拠参照。", "en": "Records linking targets, actions, and outcomes, plus evidence references for conclusions." } } ], "limits": [ { "ja": "モデルの回答やプロンプト中の注意だけを、権限制御が働いた証拠にはしません。", "en": "Model answers and prompt warnings are not proof that authorization enforcement worked." }, { "ja": "評価環境での観測、実際の事故、未確認のAI関与を混ぜません。", "en": "Keep evaluation observations, real incidents, and unverified AI involvement distinct." } ], "takeaway": { "ja": "AIへ資料を渡すことと、対象を調べて安全を確認することは別の段階です。", "en": "Giving an AI reference material and establishing evidence about a target are different stages." } }, "rules": [ { "rule": { "id": "SEC-009", "version": "1.2.1", "updatedAt": "2026-11-09", "title": { "ja": "取得・管理操作のログが揃っているか確認する", "en": "Inspect coverage of access and administration logs" }, "summary": { "ja": "ファイル取得・データ一括出力・鍵発行・管理操作を提供する環境。", "en": "Environments supporting file access, bulk exports, credential issuance, or administrative actions." }, "category": "credentials", "surfaces": ["identity", "data-store", "support"], "applicability": { "ja": "ファイル取得・データ一括出力・鍵発行・管理操作を提供する環境。", "en": "Environments supporting file access, bulk exports, credential issuance, or administrative actions." }, "targets": [ { "ja": "監査ログの種類・保管・検索クエリ", "en": "Audit event types, retention, query coverage" }, { "ja": "ファイル直接取得・鍵発行・不審な認証の通知", "en": "Direct file access, credential creation, anomalous login alerts" } ], "checks": [ { "ja": "画面経由と直接API経由の操作が両方記録され、取得漏れがないか合成イベントで確認する。", "en": "Use synthetic events to verify that UI and direct API paths are both logged." }, { "ja": "大量取得や想定外の管理操作に通知が届くか確認し、秘密や個人情報はログへ出さない。", "en": "Verify alerts for bulk access and unexpected administration without logging secrets or personal data." }, { "ja": "APIの権限変更・アカウント作成と、メンテナンス中の残存経路への操作を追跡できるか確認する。IPアドレスやUser-Agentだけで侵害を確定しない。", "en": "Verify audit coverage for API role/account changes and remaining maintenance routes; IP addresses or User-Agent alone do not establish compromise." } ], "remediation": [ { "ja": "不足するイベントの記録と通知を整え、保存期間と調査担当者を決める。", "en": "Add missing event coverage and alerts; define retention and investigation ownership." } ], "completionEvidence": [ { "ja": "合成イベントの操作から記録・検索・通知までの一連の証拠を残す。", "en": "Record synthetic event execution, collection, query, and alert delivery." } ], "limitations": [ { "ja": "ログがないことは侵害がない証拠ではありません。ログを取得できなければ未確認とします。", "en": "Missing logs do not establish absence of compromise. Unavailable logs mean unverified." } ], "incidentIds": [ "2rinkan-api-2026", "aflac-japan-2026", "ainokaze-reservations-2026", "anthropic-claude-code-abuse-2025", "anthropic-cyber-evals-2026", "anthropic-unintended-model-actions-2026", "applynow-bi-2026", "arcadia-raiden-2026", "asahi-pharma-digital-2026", "askul-2025", "awabank-test-environment-2026", "axios-npm-2026", "campfire-2026", "charm-2026", "chiba-biodiversity-2026", "chibagin-shoten-2026", "chubu-business-credentials-2026", "cloudflare-thanksgiving-2023", "cmic-ra-connect-2026", "commune-2026", "conoha-wing-2026", "coop-yamaguchi-2026", "corona-cloud-2026", "cota-2026", "daiichi-life-hr-2026", "daiki-suisan-2026", "dandm-vpn-ransomware-2026", "denmark-cpr-2026", "digital-agency-gss-2026", "discord-support-vendor-2025", "education-software-dormant-2026", "en-midcareer-credential-stuffing-2026", "epark-peakmanager-2026", "eplus-refund-2026", "estore-shopserve-2026", "expo-subcontractor-mail-2026", "fancrew-credential-stuffing-2026", "fines-reservations-2026", "five-foxes-2026", "forticloud-sso-2026", "france-refrigeration-2026", "fujita-personal-pc-scam-2026", "fukuoka-editable-application-2026", "fuso-cloud-storage-2026", "gainsight-oauth-2025", "gex-ransomware-2026", "gmo-infoq-2026", "gpoint-2026", "gyazo-2026", "hana-bank-2026", "hiho-mypage-2026", "his-thailand-2025", "ichimasa-mail-2026", "idcf-ransomware-2026", "ieej-mail-2026", "inkrevolution-payment-2025", "innovation-github-2026", "jaea-jrr3-files-2026", "jogmec-directory-2026", "jst-mail-2026", "k9natural-2026", "kaga-solnet-2026", "kamogawa-form-exposure-2026", "kb-kookmin-2026", "kddi-isp-2026", "keio-ransomware-2026", "kindal-phishing-2026", "kodansha-phishing-2026", "komatsu-user-directory-exposure-2026", "kwansei-external-sns-2026", "kyorin-remote-pc-2026", "kyoto-kyotv-exposure-2026", "leanbody-metabase-2026", "legoland-amadeus-2026", "logicvein-2025", "media4u-account-list-2026", "mediaplex-2026", "medley-atlink-2026", "metabase-2026", "mie-school-form-exposure-2026", "mitsui-fudosan-directory-2026", "miyamoto-munashi-orders-2026", "mrmax-2026", "murauchi-2026", "nice-mail-2026", "nichii-backup-exposure-2026", "nichirei-2026", "nidek-website-2026", "nihontelenet-ransomware-2026", "nikkei-m365-2026", "nikkei-workspace-2026", "nimoca-2026", "nishiyama-2026", "nostrum-smartspi-2026", "okta-support-2023", "omic-support-scam-2026", "omu-ransomware-2026", "openai-huggingface-eval-2026", "openai-mixpanel-2025", "osaka-recruitment-vendor-2026", "ota-cultural-pc-scam-2026", "ozmall-2026", "pickleballone-plugin-2026", "postman-shai-hulud-2025", "prontest-cloud-2026", "quick-2025", "rakuten-books-pc-2026", "rakuten-drive-2026", "react2shell-2025", "rust-arrayref-2026", "ryomo-systems-2026", "saga-hirakawaya-payment-2026", "sakura-billing-2026", "sakura-hosting-2026", "scala-iask-2026", "seicomart-app-2026", "seiho-contract-lookup-2026", "shueisha-hapicomi-2026", "skyticket-bus-2026", "skyticket-business-system-2026", "skyticket-server-2026", "snowflake-unc5537-2024", "studysapuri-enumeration-2026", "takaratomy-dmp-auth-2026", "temairazu-2026", "times-car-2026", "tokyometro-metpo-mail-2026", "toyobo-email-2026", "trivy-supply-chain-2026", "trunk-mail-2026", "unit42-ai-assisted-2026", "visualarts-cloud-credentials-2026", "voising-bi-2026", "weblife-oem-2026", "weverse-payment-api-2026", "white-essence-2026", "yakiniku-king-2026", "yamato-pay-later-2026", "yellowhat-booking-2026", "zurich-zdash-2026", "amadeus-breach-2026", "binance-breach-2026", "nec-contractor-breach-2026", "onamae-desktop-cloud-2026" ], "references": [ { "title": "JPCERT/CC：直近で相次いでいる国内組織における不正アクセスに関する注意喚起（10月9日更新）", "url": "https://www.jpcert.or.jp/at/2026/at260030.html" } ], "execution": "read-only-by-default", "provenance": "editorial-guidance" }, "example": { "ruleId": "SEC-009", "scenario": { "ja": "正規のログインに見える大量取得を、後から調べられるようにしたいサービス。", "en": "A service needs to investigate bulk access that may resemble ordinary authenticated use." }, "firstCheck": { "ja": "許可された設定と伏せ字済みの記録例で、何が残るかを確認します。", "en": "Review authorized settings and redacted samples to see which events are recorded." }, "lookAt": [ { "ja": "認証・管理操作・一括取得のイベント定義。", "en": "Event definitions for authentication, administration, and bulk retrieval." }, { "ja": "対象・時刻・結果を結ぶ識別情報。", "en": "Identifiers linking the target, time, and outcome." }, { "ja": "保持・時刻合わせ・閲覧権限の設定。", "en": "Retention, time synchronization, and access-control settings." } ], "evidence": { "ja": "追える操作と追えない操作、保存期間、参照した記録の範囲を残します。", "en": "Record traceable and untraceable actions, retention, and the sample scope." }, "limit": { "ja": "記録がないことを、その操作がなかった証拠にしません。秘密の値をログへ追加しません。", "en": "Missing logs do not prove an action never occurred. Do not add secret values to logs." }, "sourceIds": ["logging"] } }, { "rule": { "id": "SEC-011", "version": "1.1.1", "updatedAt": "2026-10-12", "title": { "ja": "AIエージェントの接続先と実行権限を確認する", "en": "Inspect AI-agent destinations and execution privileges" }, "summary": { "ja": "コード実行やツール接続を行うAIエージェント・評価環境がある場合に適用します。", "en": "Applies to agents and evaluation environments with code execution or tool connectivity." }, "category": "configuration", "surfaces": ["ai-agent"], "applicability": { "ja": "コード実行やツール接続を行うAIエージェント・評価環境がある場合に適用します。", "en": "Applies to agents and evaluation environments with code execution or tool connectivity." }, "targets": [ { "ja": "エージェントのネットワーク設定、パッケージプロキシ、MCP等のツール接続、サービスアカウント。", "en": "Agent network settings, package proxies, tool connections such as MCP, and service accounts." }, { "ja": "評価環境・CI・本番の境界と、接続・権限変更の記録。", "en": "Boundaries among evaluation, CI, and production, plus connection and privilege-change records." } ], "checks": [ { "ja": "プロンプトの禁止事項と実際のネットワーク制御を照合する。例外のプロキシ経由で外部や本番に到達できないか、設定と既存の試験記録で確認する。", "en": "Compare prompt restrictions with actual controls; inspect settings and existing tests for proxy routes to external or production systems." }, { "ja": "ツールごとの取得・書き込み・公開の権限を確認し、未承認の接続、共用鍵、過大な権限を探す。秘密の値は取得しない。", "en": "Inspect per-tool read, write, and publish authority for unapproved connections, shared keys, or excessive privileges without retrieving secret values." }, { "ja": "人の承認が必要な操作と、実行ログ・停止手段を確認する。モデルの自己申告を合格の証拠にしない。", "en": "Verify human approval requirements, execution logs, and stop mechanisms; do not accept model self-reports as evidence." } ], "remediation": [ { "ja": "用途ごとにサービスアカウントを分け、必要な接続先と操作に限定する。通信制御をモデルの外で実装する。", "en": "Separate service accounts by purpose and restrict destinations and operations; enforce networking outside the model." }, { "ja": "評価環境の本番接続と公開権限を分離し、例外を承認・記録する。疑わしい実行では承認範囲内で停止・鍵の失効を提案する。", "en": "Separate production connectivity and publishing authority from evaluation; approve and record exceptions and propose authorized containment and revocation." } ], "completionEvidence": [ { "ja": "対象環境のリビジョンに対応した接続先・権限の一覧と、設定の確認記録。", "en": "Destination and privilege inventory and configuration review tied to the environment revision." }, { "ja": "許可された境界試験の記録、操作の承認履歴、実行ログと停止手段の確認結果。", "en": "Authorized boundary-test records, approval history, execution logs, and verified stop mechanisms." } ], "limitations": [ { "ja": "設定を読むだけでは通信境界の有効性を保証できません。試験記録や実環境へのアクセスがない項目は未確認にします。", "en": "Settings alone do not establish effective isolation; missing tests or runtime access remain unverified." }, { "ja": "このDBを使うこと自体は、外部への通信、鍵の失効、権限変更の許可になりません。", "en": "Using this catalog does not authorize external communication, credential revocation, or privilege changes." } ], "incidentIds": [ "anthropic-claude-code-abuse-2025", "anthropic-cyber-evals-2026", "anthropic-unintended-model-actions-2026", "openai-huggingface-eval-2026", "rizap-ai-data-handling-2026", "unit42-ai-assisted-2026" ], "references": [ { "title": "OpenAI evaluation incident", "url": "https://openai.com/index/hugging-face-model-evaluation-security-incident/" }, { "title": "Anthropic evaluation incidents", "url": "https://www.anthropic.com/news/investigating-incidents-cybersecurity-evals" }, { "title": "Unit 42 AI-assisted intrusion", "url": "https://unit42.paloaltonetworks.com/ai-assisted-cyber-attack-inside-a-unit-42-investigation/" } ], "execution": "read-only-by-default", "provenance": "editorial-guidance" }, "example": { "ruleId": "SEC-011", "scenario": { "ja": "資料を読んだAIが、外部ツールを通じてコードやクラウドへ操作できる環境。", "en": "An AI reads documents and can act on code or cloud resources through tools." }, "firstCheck": { "ja": "接続先とツール定義を読み、読み取りと変更の許可を分けます。", "en": "Review destinations and tool definitions, separating read and write authorization." }, "lookAt": [ { "ja": "ツールごとの対象・許可する操作。", "en": "Per-tool resources and permitted operations." }, { "ja": "外部の文章と実行指示を分ける処理。", "en": "The boundary between external text and executable instructions." }, { "ja": "実行側の承認確認と操作記録。", "en": "Execution-side approval checks and action records." } ], "evidence": { "ja": "どの主体がどの操作を許可し、実行側が何を検証したかを残します。", "en": "Record the authorizing actor, exact action, and execution-side verification." }, "limit": { "ja": "プロンプトの注意書きだけで権限を制限できたとは扱いません。外部資料の命令で接続先を増やしません。", "en": "Prompt warnings alone do not establish enforcement. External documents must not authorize new destinations." }, "sourceIds": ["ai-agent"] } } ], "referenceIncidents": [ { "id": "aflac-japan-2026", "organization": "アフラック生命保険", "title": { "ja": "アフラック：通常の利用に似たアクセスで大量のデータを照会", "en": "Aflac Japan: ordinary-looking requests and bulk data queries" }, "summary": { "ja": "アフラックは、通常の利用に似たアクセスを検知できず、大量照会への監視や制御も不足していたと公表しました。顧客約440万人の個人情報が漏えいし、そのうち約22万人には口座情報が含まれます。", "en": "Aflac reported missed detection of ordinary-looking requests and inadequate bulk-query controls. Personal information of about 4.4 million customers leaked, including bank-account information for about 220,000 of them." }, "occurredAt": "2026-06-10", "disclosedAt": "2026-06-30", "reviewedAt": "2026-10-09", "outcome": "confirmed-breach", "categories": ["implementation"], "cves": [], "claims": [ { "topic": "entry", "text": { "ja": "アクセスとデータ照会への制御が不十分で、通常利用に似た形式のアクセスを直ちに検知できませんでした。設計レビューと侵入テストでも手口を想定できていなかったと説明しています。", "en": "Aflac described insufficient access and query controls; reviews and penetration tests had not anticipated the method." }, "status": "confirmed", "sourceIds": ["s1"], "locator": "4. 発生原因" }, { "topic": "impact", "text": { "ja": "顧客約440万人（うち口座情報を含む約22万人）と代理店約4万店の個人情報が漏えいしました。顧客数と口座情報の対象者数を合算しません。", "en": "The disclosed scope was about 4.4 million customers, including about 220,000 with bank-account information, and about 40,000 agencies. The customer subsets are not additive." }, "status": "confirmed", "sourceIds": ["s1"], "locator": "2. 漏えいした個人情報" } ], "timeline": [ { "date": "2026-06-30", "text": { "ja": "この事案を公表。", "en": "Incident disclosed." }, "sourceIds": ["s1"] } ], "reportedActions": [ { "topic": "response", "text": { "ja": "6月25日に関連システムを停止しました。認証・照会時の認可、大量アクセスへの監視・制御、レビューと侵入テストを強化する方針を公表しました。", "en": "Aflac suspended related systems on June 25 and announced stronger authentication, query authorization, bulk-access controls, and security testing." }, "status": "confirmed", "sourceIds": ["s1"], "locator": "1. 経緯 / 5. 再発防止策" } ], "prevention": { "classification": "operational-control", "assessment": { "ja": "画面のログインだけでなく、照会APIの認可と取得量の制御を確認します。通常形式のリクエストでも異常な取得量を検知できるか、試験データで点検します。", "en": "Inspect server-side query authorization and retrieval limits, and test detection of abnormal volume with synthetic data." }, "sourceIds": ["s1"] }, "ai": { "status": "unknown", "assessment": { "ja": "参照した情報では、攻撃者によるAI利用は確認できません。AI不使用を意味しません。", "en": "The cited sources do not establish attacker use of AI; absence of evidence is not evidence of absence." } }, "unknowns": [ { "ja": "具体的な攻撃リクエスト、製品名、CVEは非公表です。ライブラリの修正放置や特定のSQL注入手法とは断定できません。", "en": "Specific requests, products, and CVEs are undisclosed; this does not establish neglected library patches or a specific SQL-injection technique." } ], "sources": [ { "id": "s1", "reviewedAt": "2026-10-09", "title": "当社システムに対する不正アクセスの発生および情報漏えいに関する調査結果と再発防止策について", "url": "https://www.aflac.co.jp/static/corp/profile/news/2026/2026073100.pdf", "publisher": "アフラック生命保険", "publishedAt": "2026-07-31", "kind": "organization" } ], "ruleIds": ["SEC-008", "SEC-009", "SEC-012", "SEC-014"] }, { "id": "anthropic-cyber-evals-2026", "organization": "Anthropic / external evaluation partners", "title": { "ja": "Anthropic：評価環境の通信制限が効かず外部へ到達", "en": "Anthropic: evaluation connectivity limits failed" }, "summary": { "ja": "Anthropicは、サイバー評価中にモデルが外部組織へ到達した3事案をまとめて公表しました。評価環境の通信設定に問題があり、弱い認証や実装上の穴が悪用されました。", "en": "Anthropic disclosed three incidents of evaluation models reaching external organizations. Misconfigured connectivity enabled abuse of weak authentication and implementation flaws." }, "occurredAt": null, "disclosedAt": "2026-07-30", "reviewedAt": "2026-10-02", "outcome": "confirmed-breach", "categories": ["configuration", "credentials", "implementation", "supply-chain"], "cves": [], "claims": [ { "topic": "entry", "text": { "ja": "通信禁止の指示に反して接続可能な環境がありました。同社は高度な新規脆弱性の悪用は確認していません。", "en": "Some environments allowed connectivity despite instructions; Anthropic did not identify sophisticated novel vulnerability exploitation." }, "status": "confirmed", "sourceIds": ["s1"], "locator": "How these incidents happened" }, { "topic": "impact", "text": { "ja": "1事案では悪性PyPIパッケージが公開され、セキュリティスキャナーを含む15システムで実行されました。", "en": "In one incident, a malicious PyPI package was published and executed by 15 systems including security scanners." }, "status": "confirmed", "sourceIds": ["s1"], "locator": "Incident 2" }, { "topic": "ai", "text": { "ja": "同社は評価モデルによる3事案・6回の実行を調査対象として公表しました。", "en": "Anthropic disclosed evaluation-model activity across three incidents and six runs." }, "status": "confirmed", "sourceIds": ["s1"], "locator": "Investigation overview" } ], "timeline": [ { "date": "2026-07-30", "text": { "ja": "この事案を公表。", "en": "Incident disclosed." }, "sourceIds": ["s1"] } ], "reportedActions": [ { "topic": "response", "text": { "ja": "7月23日に当該評価を止め、通信設定・監視・評価手順の見直しを公表しました。", "en": "Anthropic reported stopping these evaluations on July 23 and reviewing networking, monitoring, and evaluation procedures." }, "status": "confirmed", "sourceIds": ["s1"], "locator": "What we are changing" } ], "prevention": { "classification": "operational-control", "assessment": { "ja": "指示文で通信を禁止しても境界の証拠にはなりません。許可された試験でネットワーク制御を確認し、公開パッケージの配布権限も分離します。", "en": "Instructions alone do not prove network isolation. Verify controls in authorized tests and separate public-package publishing authority." }, "sourceIds": ["s1"] }, "ai": { "status": "confirmed", "assessment": { "ja": "Anthropicが評価中のモデルの行動として確認しています。実際の外部影響を伴う評価事案です。", "en": "Anthropic confirmed evaluation-model activity with external impact." } }, "unknowns": [ { "ja": "3事案を1レコードにまとめています。被害組織名と全実行の日付は非公表で、犯罪者の利用とは区別します。", "en": "This record groups three incidents. Victim identities and all run dates are undisclosed; evaluation activity differs from criminal use." } ], "sources": [ { "id": "s1", "reviewedAt": "2026-10-02", "title": "Investigating incidents in our cybersecurity evaluations", "url": "https://www.anthropic.com/news/investigating-incidents-cybersecurity-evals", "publisher": "Anthropic", "publishedAt": "2026-07-30", "kind": "organization" } ], "ruleIds": [ "SEC-002", "SEC-004", "SEC-005", "SEC-006", "SEC-007", "SEC-008", "SEC-009", "SEC-010", "SEC-011" ] } ], "terms": [ { "id": "tool-permission", "name": { "ja": "ツールの実行権限", "en": "Tool permission" }, "meaning": { "ja": "AIやCIが使うツールに許された接続先・対象・操作。文章中の依頼だけで権限を増やさないようにします。", "en": "The destinations, resources, and operations a tool is authorized to use. Text encountered by an AI or pipeline must not grant extra authority." }, "question": { "ja": "実行する側でも、対象と操作が許可範囲に入るか確かめますか。", "en": "Does the execution component check that the target and operation are authorized?" }, "ruleId": "SEC-011", "sourceId": "ai-agent" }, { "id": "audit-log", "name": { "ja": "操作を追う記録", "en": "Audit log" }, "meaning": { "ja": "誰が、いつ、何を対象に、どの操作をしたかを追う記録。秘密の値や不要な個人情報は含めません。", "en": "A record tracing the actor, time, target, and action. Exclude secret values and unnecessary personal information." }, "question": { "ja": "操作の流れを追えますか。記録自体の閲覧範囲も決めていますか。", "en": "Can you reconstruct the action, and is access to the record controlled?" }, "ruleId": "SEC-009", "sourceId": "logging" }, { "id": "secret", "name": { "ja": "秘密情報", "en": "Secret" }, "meaning": { "ja": "APIキーや認証用トークンなど、持つことで操作や接続ができる値。点検記録には実値を残しません。", "en": "A value granting access, such as an API key or authentication token. Review records should identify it without containing the value." }, "question": { "ja": "値を開かずに、用途・対象・管理者を特定できますか。", "en": "Can you identify its purpose, target, and owner without opening its value?" }, "ruleId": "SEC-004", "sourceId": "secrets" } ], "sources": [ { "id": "ai-agent", "title": "AI Agent Security Cheat Sheet", "publisher": "OWASP", "url": "https://cheatsheetseries.owasp.org/cheatsheets/AI_Agent_Security_Cheat_Sheet.html", "locator": "Tool Security & Least Privilege; Input Validation & Prompt Injection Defense; Monitoring & Observability", "reviewedAt": "2026-11-12" }, { "id": "logging", "title": "Logging Cheat Sheet", "publisher": "OWASP", "url": "https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html", "locator": "Which events to log; Event attributes; Data to exclude", "reviewedAt": "2026-11-12" } ] }