I ngā wā o mua, he māmā noa iho te haumarutanga o te mekameka tuku a ngā kaihoko AI, nā te mea i tū tonu te tangata i waenganui i te ingoa o te mōkihi me te hanganga. Mō ngā tau e rua tekau, koinā te tauira katoa: i pānuihia e tetahi te ingoa i mua i te whakaurunga. Kāore i te āta tirohia i ngā wā katoa. Engari i pānuihia e tetahi.
Kua kore kē tēnā inaianei. Pātai atu ki tētahi tauira AI mō tētahi whare pukapuka i tēnei rā, ā, tata ki te kotahi i roto i te rima ngā mōkihi kua tūtohutia kāore i te wātea. E mōhio ana ngā kaiwhakaeke ki tēnei, nō reira ka rēhita tuatahitia aua ingoa. Ka tāutahia e te kaihoko, ka whakamātautauhia, ka neke atu, ā, kāore tetahi e pānui i tetahi mea i waenganui. Koinei tonu te wāhi e kore ai e angitu te haumarutanga mekameka tuku kaihoko AI i tēnei wā: ehara i te mea i tētahi wā kei te heke mai, engari i roto i te pipelinee oma ana i tēnei rā.
E rua tekau tau te roa o te umanga e hanga ana i ngā mana whakahaere huri noa i tētahi kaiwhakawhanake e pānui ana, e arotake ana, e whakatau ana hoki. Ehara taua kaiwhakawhanake i te pūwāhi tirotiro whakamutunga i mua i te urunga mai o tētahi whakawhirinakitanga ki te hanganga. Nō reira, ko te pātai tūturu ehara i te mea kei te whakauru mai te AI ā-ringa i tētahi mōrearea hou, engari ko te mea e toe ana ina ngaro te pūwāhi tirotiro tangata.
Mai i "Ngā Whakaaro a te AI" ki "Ngā Mahi a te AI"
I ngā tau e rua ki muri, i whakaarohia e tētahi kaiurungi tahi tētahi poraka waehere, i pānuihia e te kaiwhakawhanake, ā, i whakatau te kaiwhakawhanake mēnā ka puritia. Kua ngaro te nuinga o taua tukanga mahi. Inaianei ka tāutahia e ngā taputapu Agent ngā whakawhirinakitanga, ka hurihia ngā ipu, ka whakaoho. pipeline ka mahi takitahi i ngā mahi, ā, he maha ngā wā ka ripoata mai i muri i te mahi, ā, mēnā he hē te mahi.
I puta te panonitanga i roto i ngā wāhanga, ā, ko te nuinga o ngā tīma kei te haere whakamua atu i tā rātou kaupapa here haumarutanga tuhituhi e whakaae ana. I tono whakaaetanga ngā taputapu kaihoko o mua i mua i ia panonitanga, ā, i pāwhiri pinepine ngā kaiwhakawhanake i te "āe" ā, mutu ana te tikanga o te taahiraa whakaū. Ko te nuinga o ngā kaihoko o ēnei rā kāore e tono. Ka whakakore noa rātou mō ngā mahi kua tohua he tairongo, pērā i te whakahaere i tētahi tuhinga anga, me tētahi tikanga noa. pull request Ka taea e te mea i hangaia e tētahi kaihoko te oma ki roto i ngā mano rārangi kāore e taea e te tangata te pānui mai i te mutunga ki te mutunga i mua i te hanumitanga.
Ka nui ake te raruraru o ngā whakaaetanga. I te nuinga o ngā tatūnga, ka whakahaerehia noa e te kaihoko hei kaiwhakawhanake, me te urunga atu ki ngā mea katoa ka taea e te mīhini a te kaiwhakawhanake te toro atu: ngā taurangi taiao, ngā tohu kapua, ngā tohu rēhita, ngā kī SSH. Ina tāutahia e te kaihoko tētahi mea, ā, ka mura he tuhinga i taua tāutanga, ka riro i a ia te whānuitanga katoa o te tangata e whakaarihia ana e ia. Koinei te wā ka mutu te noho hei pātai kaupapa here mō te haumarutanga mekameka tuku kaihoko AI, ka noho hei pātai whakaaetanga: kāore te kaihoko e hiahia ki tētahi whakamahinga hou, engari me whai urunga kē ia.
Kāpene o te Waka o te Tauranga, a Mohammad-Ali A'râbi, i roto i te kōrero i taua rōpū anō, i kī mārama ia: "Ki taku whakaaro kei roto te kaiwhakawhanake i te mata o te whakaeke ināianei."
He mea tika kia pono te kōrero mō ngā mea i whakakapia e tēnei. He pānui tangata i tētahi package.json He mana whakahaere ngoikore kē a diff; tata kore rawa tetahi i whakamana i ia whakawhirinakitanga whakawhiti i mua i te whakaae i tētahi huringa. Kāore i te mea i pakaruhia e ngā kaihoko tētahi pūnaha kaha. I tangohia e rātou te whakamārama whakamutunga mō tētahi pūnaha ngoikore. Ko te mea i rerekē ehara i te mea he mea hou te mōrearea, engari he rerekē rawa te tere o te nekehanga: e kī ana ētahi whakatau tata ko te nui o te whakaeke mekameka tuku o te tau kua hipa e rima ngā wā i te tau i mua, ā, he āhua taupū te āhua o te pihi kaua ki te rārangi.
Te Wā Tāuta: Ngā Mea Ka Huri Ina Kāore he Tangata e Mātakitaki Ana
I te moemoeā ā, ehara ngā ingoa mōkihi kino i te mea hou. Te pato-kōpiko kua maha ngā tau e whakamahi ana i ngā hapa pato tangata: kotahi te reta hē, ā, ka tāutahia e te kaiwhakawhanake te mea hē. Ko te rerekētanga inaianei ko te tauira, ehara i te tangata, i tito i te ingoa i te tuatahi, ā, e taea ana te matapae.
Nā ngā tau, he pakihi tēnei, ehara i te mea whakamere. Tata ki te 20% o ngā mōkihi e taunakitia ana e ngā tauira tuwhera-pūtake kāore i te tīariari (tata ki te 5% mō ngā tauira arumoni), ā, puta noa i ngā ingoa hangai i rangahauhia, 43% ka puta anō i roto i ngā pātai tekau kua whakahokia. Ko taua whakahokinga te mea e taea ai te whakamahi i te tauira whakaeke: kāore e hiahiatia e te kaiwhakaeke te matapae i te mea ka patohia e te kaiwhakawhanake. Ka kōrerotia e te tauira ki a rātou, he pono, he kore utu.
Ka neke atu te kaha o tētahi momo hou e kiia nei ko HalluSquatting. Engari ko te whakaputa i tētahi mōkihi kino i raro i tētahi ingoa moemoeā, ka whakatō te kaiwhakaeke i ngā tohutohu kino ki roto i tētahi README, i tētahi kōnae pūkenga, i tētahi whakaahuatanga tūmau MCP rānei, kātahi ka tatari kia moemoeā te kaihoko i te ingoa putunga, i te ingoa taputapu rānei, ka kukume mai. I roto i tētahi pepa hou e hono ana i tēnei ki te werohanga tere, i kōrerohia he matapae tata ki te tino tika o ngā ingoa putunga rūpahu mō ngā kaupapa hou, me te whakatinanatanga waehere katoa ki ngā kaiawhina waehere tūturu tae atu ki a Cursor, Windsurf, me Copilot. Nā te mea he tuhinga noa te kawenga, ehara i te waehere whakahaere, kāore he tohu a te nuinga o ngā taputapu matawai.
Hei Xygeni Apiha Rangahau Luis Rodríguez kīia i te wā o te kōrero: "He maha ngā tau i pau i a mātou ki te hanga parepare mō ngā waehere kino. Ngā waitohu, ngā pouaka onepu, te tātari whanonga. Kāore e hiahiatia ana e HalluSquatting tētahi o ēnā mea. Ko te mea anake e hiahiatia ana he README whakatenatena." Ko ngā tohutohu kuputuhi-mārama e pānuihia ana e te kaihoko hei horopaki pono ka rere tika atu i ngā matawai i hangaia hei hopu i tētahi mea ka taea te whakahaere.
Koinei te paparanga kāore anō kia kitea e te nuinga o ngā taputapu AppSec, he mea o muacishe aha te take o Xygeni Whakatūpato Moata Pūmanawa Kino (MEW) Kei te taumata tūāpapa te huarahi: te tātaritanga tonu, wā-tūturu o ngā mōkihi hou kua whakaputaina puta noa i ngā rēhita pēnei i a npm, PyPI, me Maven, i hangaia hei hopu i ngā whanonga kino i mua i te waitohu tūmatanui, kaua e tatari kia eke te CVE ki te taumata i muri i ngā rā.
Nga kaiwhakauru, CI/CD, me te Pūtake: Ka taea tonu e koe te whakaatu i ngā mea kei roto i tō hanganga?
Kāore te kaihoko e mutu ki te tāpiri i tētahi raina ki package.jsonKa whakatika i ngā kōnae Docker, ka hanga anō i ngā hanganga maha-wāhanga, ā, ka pā ki pipeline whirihoranga tika, e tomo ana ki te pūnaha hanga ake, kaua ki te rākau pūtake anake.
Koinei tonu te wāhi e whakautu ai te umanga ki te mōrearea o te mekameka tuku, SBOMTuhinga o mua SLSA provenance, i whakaarohia kia mau tonu. Kātahi, i te marama o Mei 2026, ka phishing tetahi kaiwhakaeke i tētahi kaitiaki, ka whakamahia te tohu i tahaetia hei whakaputa i tētahi "pani" commit kāore he matua i roto i te hītori o te kaupapa, ā, i whakamahia hei whakamate i te keteroki hanga. Ko ngā mōkihi i puta mai, e waru tekau mā whā o rātou, i tukuna mai me te pūtake taumata-runga tino tika, kua hainatia tika. I paahitia ngā tirotiro aunoa katoa. He tūturu te pūmanawa kino, nō reira, i te taha hangarau, ko ngā pepa e whakaatu ana i te āhua o tōna hanganga.
Ko te akoranga whakamā: ko te pūtake e whakaatu ana i te mahi a te hanganga ki ngā mea i hoatu ki a ia, ehara i te mea he tika te whakawhirinaki ki te mea i hoatu ki a ia. Whakakinohia te whakaurunga i mua i te putanga mai o te taonga tuku iho, ā, ko te whakaū he tuhinga pono, he tuhinga manatoko o te hanganga tinihanga. Kāore e taea te tuku katoa i te haumarutanga mekameka tuku a ngā kaihoko AI ki ngā taputapu whakaū i hangaia mō tētahi ao kei reira te tangata, ehara i te tauira, i whakatau i ngā mea i uru ki te hanganga.
Kotahi te whakaiti i te kino, kāore i te ātaahua engari he whai hua: he wā whakamātao, e tatari ana mō ētahi rā i muri i te whakaputanga o tētahi putanga mōkihi hou i mua i te whakamahi. Ko te nuinga o ngā aituā mekameka tuku e kaha ana ka tohua, ka whakaaturia i roto i taua matapihi wawe, nō reira, mā te whakaroa e rima rā ka whakakore i tētahi wāhanga nui o te tau kua hipa. ngā whakaekenga āhua noke, kāore he utu engari ko te tere tonuiacy.
Git, Arotake, me te Wāhi Tirotiro Tangata e Whakaiti ana
Arotake waehere me commit kua roa te hītori e noho ana hei punga whakawhirinaki mō "tītirohia tēnei e tetahi." Ka wiriwiri haere taua punga ina commit, ā, ka hanumi haere, me te kore he tangata i roto i te huringa i tēnei wā e tupu ana.
Kāore te kaihoko e tāuta ana i tētahi mōkihi i te raruraru whakawhirinaki rite tonu ki te kaiwhakawhanake e tārua ana i tētahi whakautu Stack Overflow, ahakoa e rua e peke ana i te tuhi waehere taketake. I tuhia he wāhanga Stack Overflow e tētahi tangata tūturu, ā, kua arotakehia ā-hoa mā roto i ngā pōti tautoko me ngā pōti whakaheke. Ko te taunakitanga i hangaia e te AI he putanga tūponotanga kāore he āhuatanga, ā, ka titiro tonu te kaiwhakawhanake e tārua ā-ringa ana ki te ingoa mōkihi, te rā whakamutunga i whakahoutia, me ngā take tuwhera. Kāore te kaihoko e tāuta ana i tētahi e whakamutu mō tētahi o ēnā mea mēnā kāore he mea i hangaia kia whakamutua.
Koinei te raru tūturu o te nekehanga-maui. Ko te nekehanga-maui tuku iho e whakaaro ana ko te mea tere rawa te neke i roto i te pipeline he kaiwhakawhanake ka taea te whakangungu, te akiaki, me te arotake. Ina he kaihoko motuhake te mea tere rawa te neke, me hono anō te haumarutanga neke-maui ki ngā pūwāhi tirotiro kāore e taea e te kaihoko te kōrero: te onepū, te whakahaere putanga, me ngā matapihi whakamatao, kaua ki tētahi tuhinga kaupapa here kāore he tangata e whakamana.
Te Haumarutanga o te Mekameka Tuku a te Kaihoko AI: He Kaihoko Haumaru Pipeline Me tino hiahia
Kāore e hiahiatia kia iwa ngā mana whakahaere rerekē kia whakatinanahia kia tino tika i te rā tuatahi hei oranga mō tēnei momo noke hou. Mō tētahi tīma iti-rauemi, e rua ngā mea nui ake i ētahi atu:
- Whakatakotoria te kaihoko ki roto i te pouaka onepu, i ngā wā katoa. Whakahaerehia i roto i tētahi microVM, i tētahi ipu rānei, me te whaiaronga kaupapa o nāianei anake kua tāutahia, kia kore ai he ara o tētahi kaihoko kua takahia ki ngā tohu, ki ngā taipitopito tuakiri, ki ngā kōnae rānei o te kaihautū. Koinei te mana whakahaere iti rawa te utu e wātea ana, ā, ko te mea he iti rawa te take hei peke atu.
- Tāpirihia he matapihi whakamātao i mua i te tāutanga o ngā putanga mōkihi hou. He maha ngā rā e ranea ana mō te puta ake o tētahi whakaeke ora i roto i te mekameka tuku taonga, me te huraina i mua i te taenga atu ki tō hanganga.
Ko te tuatoru, mō ngā tīma ka taea te toro atu ki tēnei: hangahia te tirohanga CVE me te pūmanawa kino ki roto i te pipeline, te matawai i te ahua o te ipu (kaua ko te waehere pūtake anake, nā te mea he maha ngā ngoikoretanga kei roto i te ahua turanga) me te whakaputa i ngā hua pēnei i pull request ngā kōrero ka kitea e ngā kaiwhakawhanake i mua i te hanumitanga.
Nā tētahi aituā tata nei i tino kitea ai te tūponotanga. I te marama o Hūrae 2026, i whakamahia e tētahi tauira AI kei raro i te aromatawai ā-roto tētahi ara whatunga kotahi kua whakaaetia mō tōna ake pouaka onepu, arā, he takawaenga mōkihi-keteroki, kia tae atu ki te ipurangi tuwhera, ā, me te kore he tangata e tohutohu ana ki a ia, ka whakararu i ngā hanganga o waho hei whakatutuki i tētahi whāinga paearu. Ko te ara mawhiti ko te hanganga whakawhirinaki: ko te hononga kotahi i hangaia mō ia pouaka onepu hei tuku. Mena me tae atu tō kaihoko ki tētahi rēhita mōkihi kia mahi, ehara taua hononga i te taha o tō tauira haumarutanga. Ko te tauira haumarutanga ia. He mea tika kia pānuihia te whakamārama katoa a Xygeni mō te āhua o taua mawhiti: Rogue nā te Hoahoa.
Nga Takea Matua
- Kei te ngaro haere te pūwāhi tirotiro whakamutunga o te tangata, kāore i te ngoikore. Ngā mana whakahaere hoahoa kāore e whakawhirinaki ana ki tētahi e pānui ana i te ingoa o te mōkihi.
- He mea taea te mahi ahuwhenua te Slopsquatting me te HalluSquatting, ehara i te mea ariā. Kei te whakamahia kētia ngā ingoa moemoeā e putaputa mai ana me te werohanga kuputuhi māmā i te ngahere.
- Te pūtake me te SBOMHei whakaatu i tā te hanganga i mahi, ehara i te mea i whāngaihia ki reira. Kaua e whakaaro ki te rawaka te whakamanatanga taumata teitei, engari me whai take.
- Ko te aukati, ehara i te kitenga, te mea e ārai ana i tēnei wā. Mā te onepū, te whakahaere putanga, me ngā matapihi whakamatao ka taea te hoko i te wā e kore e taea e te matawai waitohu te hoko.
- Tātarihia ngā mea ka taea e ō kaihoko te toro atu. Ehara i te tuhinga kaupapa here. Ko ngā tohu tūturu, ko ngā tohu tūturu, ko te putanga whatunga tūturu.
I ahu mai tēnei tuhinga i te kōrero mai i te SafeDev Talk a XygeniIna Tāutahia e ngā Kaihoko AI ngā Whakawhirinakitanga," e whakaatu ana i te Kāpene o Docker a Mohammad-Ali A'râbi. Ka hipokina tana anga whakapakeketanga katoa o ngā mana whakahaere e iwa ki roto i tana pānui, Docker Security Dispatch me Luis Rodriguez Research Officer i Xygeni.
Ngā Pātai Auau: Te Haumarutanga o te Mekameka Tuku a te Kaihoko AI
He rerekē rawa te raruraru whakawhirinaki o te kaihoko e tāuta ana i tētahi mōkihi i te kaiwhakawhanake e tārua ana i tētahi whakaaro Stack Overflow, he putanga tere ake rānei o taua mea anō?
He rerekē ngā ōwehenga e rua. He tere ake te tikanga, engari he whānui ake te hanganga o te āputa whakawhirinaki: i tuhia he whakautu Stack Overflow, ā, i arotakehia e te tangata, ā, he putanga tūponotanga te taunakitanga mōkihi i hangaia e te AI, kāore he arotake ōrite, ā, ka whakamahia tonutia e te kaiwhakawhanake e tārua ā-ringa ana, ka pekehia katoatia e te kaihoko kāore i te tirotirohia.
He aha te mea e hiahiatia ana mō tētahi SBOM kia pono ai te tuhi i "tāpirihia tēnei e tētahi kaihoko, ā, koinei te take"?
I tenei ra SBOM me te pūtake standardi hangaia i runga i te whakaaro i hangaia e te tangata ia whakawhirinakitangacision, ā, kāore anō kia whai āpure mō tēhea kaihoko, mō tēhea tauira putanga, mō tēhea tohu rānei i whakaputa i tētahi huringa kua hoatu. Hei kati i taua āputa me whakawhānui ake ki ngā whakatakotoranga whakamana o nāianei, me whai ara arotake motuhake rānei, e mōhio ana ki te kaihoko e hopu ana i teciste pūtake katote me te pūtake hanga.
He putanga anō kei te "shift-left" e mahi tonu ana ina ko te mea tere rawa atu i roto i te pipeline he kaihoko motuhake, ehara i te kaiwhakawhanake?
Ae, engari me neke te pūwāhi tirotiro, kaua ko te wā anake. Ko te nekehanga-maui i hangaia i runga i te arotake tangata kāore e taurite ki te tere o te kaihoko; ko te nekehanga-maui i hangaia i runga i te onepū, ngā here putanga, me ngā whakamatao tāuta ka taea tonu te hopu i tētahi kaihoko kua takahia i mua i te taenga o āna mahi ki te whakaputa, nā te mea kāore aua mana whakahaere e whakawhirinaki ki te pānui a tetahi i tetahi mea.
