AWS 发布 AI 漏洞分诊 steering 文件配置指南

1. 05:49
   AWS SecuritySelected

   AWS releases configuration guide for AI vulnerability triage steering files

   The AWS security team published a configuration guide for an AI vulnerability triage harness, using a steering file to codify the team's triage methodology as persistent instructions loaded by the model on every session. The guide gives five key configuration sections: first perform structural validation, requiring confirmation that files, functions, data flows, and call paths exist before reporting findings; use a binary signal weighting formula instead of the model's self-reported confidence, with a taint confirmation weight of 0.30; parse IaC and apply multipliers by control type, where attack-blocking controls can stack with a floor of 0.15; incorporate CISA KEV, EPSS, and public PoC signals with a total bonus cap of +0.50; finally, divide scores into four tiers from P0 to P3 for handling. The authors state that without steering, about 30% of findings referenced code structures that did not exist in the repository, and after adding it, no fabricated paths appeared in testing; on a test application with 10 known vulnerabilities, the model found 9 after steering and downgraded two findings mitigated by infrastructure to P3.

2. 05:49
   AWS Security

   AWS 分享构建 AI 漏洞测试框架的三层流水线

   AWS 安全团队介绍了一套三层流水线，把漏洞扫描器产生的大量候选发现收敛为少量带证据的高优先级问题。第一层用多扫描器一致性判断可信度，第二层借助代码的抽象语法树验证扫描器描述的函数、文件与数据流是否真实存在，第三层结合 CloudFormation、Terraform 等 IaC 模板评估 WAF、网络隔离、认证等控制措施能否被绕过。作者强调该架构与具体工具无关，可替换自有扫描器和模型，并给出按索引、多扫描器分诊、假设生成、基础设施上下文、实机验证的顺序逐步落地的建议。文章同时说明该框架不负责修复代码、不替代人工复核，也无法覆盖扫描器检测范围之外的漏洞类型。

Current attention45·Peak in the comparable period49（Oct 8 07:00）·Change over the comparable past 24 hours 0%