Mō ngā tau kua taha ake nei, he rohe mārama tō te haumarutanga o ngā tono: ko te putunga raraunga me te pipelineKoinei te wāhi i noho ai ngā mana whakahaere, te wāhi i whakahaerehia ai ngā matawai, te wāhi i whakatau ai ngā tīma mēnā ka tukuna he mea ki te hanga. I whakawhirinaki katoa ki tētahi whakaaro: i whiriwhiria māramatia e te kaiwhakawhanake ko tēhea waehere me ēhea whakawhirinakitanga ka uru ki te pūnaha.
Kāore taua whakaaro e mau tonu ana. He nui haere te wāhanga o te waehere i ēnei rā e tuhia ana, e whakaarohia ana, e tāutahia ana rānei e tētahi kaihoko AI, he maha ngā wā kāore he tangata e titiro ana ki te ingoa o te mea e kumea ana. Ina tecisKa neke te kaha o te mea e uru ana ki te waehere, ka neke anō hoki te whakaeke. Ka neke ki mua rawa o te tukanga: i te wā tonu ka hangaia te waehere, i roto i te kaiawhina tonu, me ngā kōnae e whirihora ana.
Koinei te mata o tō whakaekenga AI: ko ia tauira, ko ia kaihoko, ko ia tūmau MCP, ko ia pūkenga, me ia whakawhirinakitanga e whakaarohia ana e te AI ka taea te whakauru i te mōrearea i mua i te arotakenga a te tangata. Ko taua AI e whakawhirinakihia ana e ō kaiwhakawhanake kua whai wāhi inaianei. Ehara tēnei i te mōrearea ā muri ake nei. He panonitanga kua puta kē, ā, koinei te āhua o te mahi.
He ngaru o ngā whakaeke, ehara i te mea takitahi
Kāore tētahi o ēnei e whai ake nei he mahi taiwhangacishe whakapae rānei. He tūmatanui ēnei, he mea tuhi, tata katoa mai i te tau kua hipa, ā, he tata ake ia mea ki te kaiwhakahaere AI tonu:
- Ākuhata 2025, te s1ngularity: I tahaetia e ngā kaiwhakaeke tētahi tohu whakaputa mai i a Nx, tētahi o ngā pūnaha hanga e whakamahia whānuitia ana, ā, i tukuna ngā putanga kino ki te npm, mā te whakamahi i ngā taputapu AI hei rapu i ngā mea ngaro i runga i ngā mīhini a ngā kaiwhakawhanake.
- Hepetema 2025, tioka/whakatikatika: Ko tētahi o ngā whakataunga nui rawa atu a te npm mā te reach, 18 ngā mōkihi me te neke atu i te rua piriona tango ia wiki, i tangohia mā te tahae o te pūkete a te kaitiaki kotahi.
- Hepetema 2025, Shai-Hulud: tētahi o ngā noke tuatahi kua tuhia ka taea te whakatipu i a ia anō mā te npm. Ko tana ngaru tuarua, i te marama o Noema, he kaha ake, ā, e hono ana ki ngā mea ngaro i huraina puta noa i te 25,000 ngā putunga raraunga.
- Oketopa 2025, ngā kawemai-kāore i whakamahia: he wāhanga o te pakanga PhantomRaven, i reira i whakaurua ai e te moemoeā AI te pūmanawa kino tūturu ki roto i te npm mā te tikanga slopsquatting.
- I tēnei tau, ko ClawHub: he rēhita pūkenga AI kua paitinihia, ā, e rima o ngā pūkenga e whitu i tino tikiakehia he pūmanawa kino.
Kei te whakamanahia e te umanga te whakatau kotahi. Ko te OWASP Top 10 mō ngā Tono LLM e whakanoho ana i te werohanga tere ki te nama tuatahi. Ko te OWASP MCP Top 10 (kei roto i te beta i tēnei wā) e aro ana ki ngā kaihoko kawa e whakamahia ana hei kōrero ki ngā taputapu. Ko te OWASP Agentic Skills Top 10, he kaupapa hou kei te wāhanga Incubator, e kī ana i ngā pūkenga kino hei mōrearea nui. I te nuinga o te wā ka neke a OWASP me te tupato; mā te whakatuwhera i ngā taha e toru i te wā kotahi, ko tētahi o rātou e tere ana, e kī ana i te tere o tēnei nekehanga.
E kotahi te whakaaro o ēnei e toru: ko ngā tohutohu, ngā taputapu, me ngā whirihoranga huri noa i tētahi tauira kua uru inaianei ki te mata o te whakaekenga AI, ā, kei roto tonu i tō ake putunga raraunga. Koia nei te pātai tuatahi e tika ana kia pātaihia ki ō rōpū: ko wai e arotake ana i ngā kōnae ture, ngā pūkenga, me ngā whirihoranga MCP kei roto i tō putunga raraunga?
Wetereo 1: te pūkenga paitini
He kōnae tohutohu me ngā āheinga te pūkenga e whakaako ana i te kaiwhakahaere AI ki te mahi i tētahi mahi. Ehara i te mea koinei anake te huarahi hei hanga i te whanonga a te kaiwhakahaere (ngā kōnae ture, hooks, me ngā whirihoranga MCP anō hoki), engari kotahi te āhuatanga e tohaina ana e rātou katoa: ka haere rātou i roto i te putunga raraunga, me te waehere.
I arotakehia e te rangahau i tēnei tau te 4,000 o ēnei pūkenga:
- 36% i pāngia e te iti rawa kotahi te hapa haumarutanga.
- 13.4% i tino hira.
- Tata ki te 100 he kawenga kino tō rātou.
Te panonitanga matua: kāore te kaiwhakaeke e aro ki tō waehere. Ka aro atu rātou ki te kaihoko e tuhi ana i tō waehere, ka whakatō tohutohu huna (i ētahi wā ka whakamahia ngā tohu kāore e kitea) ka pānuihia e te tauira, ā, ka whakaarohia he mahi. Ka whakaaetia e te kaitātari tangata te pull request i runga i te ngākau pono nā te mea, ki tā rātou titiro, he ma te āhua o te kōnae. Ka whakamārama te tauira i ngā tohutohu kāore i kitea e te kaiarotake.
Ehara tēnei i te ariā noa iho. Nā te CVE-2025-59536 (CVSS 8.7) i āhei te whakarewa i te Claude Code mai i tētahi putunga kāore i te whakawhirinakihia, i reira ka taea e tētahi whirihoranga kino te whakahaere i ngā whakahau i mua i te whakaae a te kaiwhakamahi ki te pouaka kōrero whakawhirinaki. Nā tētahi ngoikoretanga tuarua, arā, ko te CVE-2026-21852, i āhei te tango i tētahi kī API mā te whirihoranga e whakahaerehia ana e te kaupapa, me te kore e whakaaetia e te kaiwhakamahi tetahi mea.
H2: Wāhanga 2: te noho pōturi
Ka whakakotahi te ingoa i te "slop" (te para e hangaia ana e te AI i ētahi wā) me te whakaeke typosquatting matarohia. Ka whakawhirinaki te typosquatting ki ngā hapa tangata: ka rēhita te kaiwhakaeke i tētahi ingoa mōkihi e tata ana ki tētahi ingoa rongonui, ā, ka tatari kia puta he hapa typo. He mea matapōkere.
Te noho pōturi kāore e tatari kia puta he hapa. I roto i te rangahau i whakahuatia i tēnei wā, 19.7% o ngā tohutoro mōkihi i hangaia e ngā tauira AI i tohu ki ngā mōkihi kāore i te tīariari. Ka pohehe ngā tauira i ngā ingoa ōrite i ngā wā katoa, nō reira ka mātakitaki te kaiwhakaeke ko ēhea ingoa ka hangaia e te AI, ka rēhita i aua ingoa ki te waehere kino, kātahi ka tatari kia uru mai te tāutanga AI e whai ake nei ki roto i tō taupānga.
Ehara i te mea iti te tauine: Neke atu i te 450,000 ngā mōkihi kino hou i kitea i te tau 2025. E rua ngā tauira hei whakapūmau i tēnei:
- I whakatōkia e tētahi kairangahau tētahi kete whakamātautau kore kino e kiia nei ko awhi-kanohi-cli hei whakamātau i te kōrero. I tuhia neke atu i te 30,000 ngā tango i roto i ngā marama e toru.
- ngā kawemai-kāore i whakamahia, mai i te rārangi wā i runga ake nei, i whakaūtia he pūmanawa kino, kei roto i tētahi rēhita tūmatanui, mā te whakamahi i tēnei tikanga tonu. Ehara tēnā i te whakamātautau.
Ehara te pātai i te mea ka pā tēnei ki tō rōpū. Engari ko te maha o ngā mōkihi kua tūtohutia e te AI e uru ana ki tō waehere i tēnei rā, me te kore e tirohia e tetahi.
Ko te whakautu: standardkei te hopukina e rātou
E rua ngā ope e oma tahi ana. I te tere haere o ngā whakaeke, standardKei te tauhohe ngā tinana o te tangata:
- NIST SP 800-218A ka whakawhānui i te anga whakawhanake pūmanawa haumaru me ngā mahi motuhake ki ngā tauira AI, tae atu ki ngā taunakitanga o te pono me te pūtake.
- In Maehe 2026, CISA me ōna hoa G7 o te ao he aratohu kua whakaputaina mō tētahi Pire Rauemi Pūmanawa mō te AI, e tautuhi ana i ngā mea e tika ana mō taua rarangi taonga: ngā tauira, ngā huinga raraunga, ngā wāhanga, ngā kaiwhakarato, me ngā whakawhirinakitanga.
He mārama te aronga: te SBOM kei te whānui haere hei AI-BOM. Kāore e taea e koe te whakamana, te whakaatu rānei i ngā mea kāore e taea te whakarārangi. Ā, i ēnei rā, kāore e taea e te nuinga o ngā whakahaere te:
- 43 orau kāore e taea te arotake, te whakarārangi rānei i ngā taputapu AI e whakamahia ana e rātou.
- 79 orau kāore he tirohanga ki ngā kaiwhakahaere AI me ngā pūnaha MCP e rere ana i roto i tō rātou ake taiao.
I roto i ngā taiao whakahaere ture, kei te neke haere tēnei rarangi taonga mai i te mahi pai ki te tumanako kirimana, ki te herenga tutuki rānei. Engari ko te rarangi taonga anake e whakaatu ana i tāu e whai nei. Mēnā ko ia anake, kāore e ārai i tētahi whakaeke.
Te āputa: he EDR mō AppSec
SAST a SCA Kua hangaia ngā taputapu hei tātari i te waehere me ngā whakawhirinakitanga, ehara i te whanonga o tētahi kaihoko, o tōna whirihoranga rānei. He BDU ka kite i ngā tukanga me ngā hononga whatunga, engari i te nuinga o te wā kāore i roto i te horopaki haumarutanga-tono hei whakamārama i tētahi whakawhirinakitanga, i tētahi whirihoranga kaihoko rānei. Kei waenganui i aua momo taputapu e rua he āputa, ko te wāhi tonu tēnei e hangaia ana te waehere, me te wāhi tonu hoki e noho ana te mata whakaeke AI.
E toru ngā wāhi matapo o taua āputa:
- Ngā rawa o te AI. Kāore ngā tauira, ngā kaihoko, me ngā tūmau MCP e puta mai ana i runga i tō SAST's SCAte radar. Kāore e taea e koe te rarangi i ngā mea kāore e kitea e koe.
- Ngā kōnae whirihoranga. Ka arotakehia ngā pūkenga, ngā ture, me ngā whanonga āhua o ngā kaihoko whirihoranga MCP, me te mea he kuputuhi noa iho, kāore he kino.
- Ngā tāutanga mōkihi. A ka taea e te whakawhirinakitanga kino te rere i mua i te mōhiotia he kino, kātahi ka hura i ngā mea ngaro me ngā tohu, me te kore e whakaaetia e tetahi.
Te āhua o te kati a Xygeni
Ngā mahi a te EDR mō ngā pito mutunga, Xygeni E mahi ana a Shield mō te huringa whanaketanga ā-AI: ka tiaki i te wāhi i hangaia ai te waehere me te mārama hoki ki te horopaki haumarutanga-taupānga.
- Te tirohanga ki hea SAST a SCA kaua e tae atu. Ka tohu a Xygeni i ngā pūkenga kino me ngā kōnae ture, ka tātari i ngā whirihoranga MCP, ā, ka hanga i tētahi pūnaha arotake-rite AI-BOM, kua maherehia ki te OWASP LLM, MCP, me ngā Tohu Paetahi 10.
- Te mātauranga, ehara i te waitohu anake. Ka tātarihia e te MEW (Malware Early Warning) te whanonga me te mōrearea o tētahi mōkihi hei aukati i mua i te putanga mai o tētahi CVE, he tohutohu, he waitohu tūmatanui rānei. Mā te mātauranga whatunga hou e tapahi ngā hononga ki ngā hanganga e mōhiotia ana he kino.
- Kotahi te pūwāhi whakahaere, mai i te waehere ki te pūwāhi mutunga. He māngai kotahi, kua whakatinanahia me te kore e hanga hou i te taiao, me te mana motuhake raraunga me ngā taunakitanga tutuki i ngā whakaritenga a Ūropi.
I roto i tētahi whakaaturanga ora, i āraihia e tēnei whakatinanatanga kaupapa here te ngana a tētahi kaihoko AI ki te tāuta i tētahi mōkihi kino puta noa i ngā ara tāutanga rerekē e toru (taiao mariko, kaiwhakahaere mōkihi, me te tango tika) i mua i te otinga o te tāutanga, i takiuru katoa i te wā tūturu me te kaweake ki tētahi SOC. Ko te whakaurunga o tētahi kaupapa tuatahi he tikanga ka roa te haora; ko te whakawhānui i te kapinga puta noa i tētahi whakahaere katoa he tikanga ka roa te kotahi ki te rua wiki, i runga i te hanganga.
FAQ
He aha te mata whakaeke AI i roto i te paraka kotahi?
Ko te mata whakaeke AI ko te huinga o ngā tauira, ngā kaihoko, ngā tūmau MCP, ngā pūkenga, ngā kōnae ture, me ngā whakawhirinakitanga kua tūtohutia e AI e taea ai e te mōrearea te uru ki roto i tētahi tono, i mua i te arotakenga a te tangata. Ka horapa atu i tua atu i te waehere me ngā whakawhirinakitanga tuku iho, tae atu ki ngā kōnae whirihoranga me ngā tohutohu e hanga ana i te whanonga a tētahi kaihoko AI.
Me pēhea taku mōhio mēnā he moemoeā noa iho te ingoa mōkihi i tūtohutia mai e taku kaiawhina AI, he pono rānei engari kāore i te mōhiotia?
Whakamanahia i mua i te tāutanga: tirohia te rēhita me te tātari i ngā ihirangi me te kaupapa tuturu o te mōkihi, kaua e whakawhirinaki ki te ingoa anake. Ka aunoa a Xygeni i tēnei whakamana i te wā tūturu i te wā e whakaputa ana i te waehere, kia whakaaetia, kia āraia rānei te tāutanga i mua i te rere, ahakoa e mōhio ana koe ki te mōkihi, kāore rānei.
He rite tonu te pānga o te noho pōrearea ki ngā tauira AI katoa?
I roto i te rangahau i muri i te tatauranga 19.7%, i hipokina e te rangahau ngā tauira maha, ā, i kitea he whānui te horapa o te take, he iti noa te rerekētanga i waenga i a rātou. He tauira tēnei puta noa i te whanaketanga āwhina-AI, ehara i te hapa motuhake ki tētahi kaiawhina.
Ka taea e tātou te tirotiro whakamuri mēnā kua tāuta kētia e tātou he mōkihi moemoeā, he mōkihi kino rānei?
Āe. Mā te tūāpapa a Xygeni ka taea e ngā kiritaki te uru atu ki tētahi pātengi raraunga o ngā mōkihi kino kua kitea, ka taea te rapu i roto i tō rarangi wāhanga o nāianei, kia taea ai e koe te whakaū i roto i ētahi pāwhiri noa iho mēnā he tūmomo riri kua tāutahia kētia.
Kia pēhea te roa o te whakatinanatanga mō tētahi whakahaere rahi-waenga me ngā tīma maha?
Ko te whakaurunga o tētahi kaupapa tuatahi he tata ki te kotahi hāora te roa. Ko te whakawhānui ake i tētahi whakahaere katoa he kotahi ki te rua wiki te roa, i runga i te hanganga o te tīma me ngā tikanga mahi.
Maherehia tō mata whakaeke AI, mō te kore utu
Tātaitia te tapuwae AI o tō tono mō te kore utu: waihangahia he pūkete, ā, whakahaere i te matawai tuatahi i roto i ngā menetiTīmata ki tētahi taupānga kotahi, tirohia he aha te AI kei roto, ā, tirohia ko tēhea wāhanga o te mata o tō whakaeke AI he morearea.
*Ko ētahi o ngā āheinga kua whakahuatia i runga ake nei ka whakamanahia mā Xygeni Shield me te ASPMNgā kōwae Haumarutanga /AI; ka rerekē pea te wātea i runga i te mahere. Tirohia xygeni.io mō ngā taipitopito hua o nāianei.
