Kei te tere ake te tuku a ō kaiwhakawhanake i ngā āhuatanga. Kei te whakauru mai hoki rātou i ngā ngoikoretanga haumarutanga i te tere kāore i hangaia e tō taputapu o nāianei kia whakahaerea.
Kāore ngā taputapu waehere AI e whakateretere noa i te whanaketanga. Ka whakatereterehia hoki te whakaurunga o ngā waehere kore haumaru. Ko te Kaupapa Radar Haumarutanga Vibe o Georgia Tech i tuhia e 35 ngā CVE hou i te marama o Poutū-te-rangi 2026 anake e pā tika ana ki ngā taputapu waehere AI, mai i te 6 i te marama o Hānuere. E ai ki ngā kairangahau ko te tatau pono e rima ki te tekau ngā wā teitei ake puta noa i te pūnaha tuwhera whānui. Rangahau CSA i kitea he 62% o ngā waehere i hangaia e te AI kei roto ngā hapa hoahoa, ngā ngoikoretanga rānei e mōhiotia ana, ahakoa kei te whakamahi ngā kaiwhakawhanake i ngā tauira taketake hou.
Ehara tēnei i te raruraru ka whakatauhia e koe mā te tono ki ngā kaiwhakawhanake kia whakaroa. Ko te whakautu ko te hanga i ngā hanganga haumarutanga e rite ana ki te tere o te whanaketanga AI, ā, kāore anō kia whai i tēnei i te nuinga o ngā tīma.
Te Āputa Kāore e Kitea e te nuinga o ngā Tīma Kia Roa Rā anō
Ka hangaia e ngā taputapu waehere AI tētahi raruraru haumarutanga motuhake kāore i hangaia mōna te hanganga AppSec tuku iho: he waehere tere-rahi, he waehere nui-rahi me ngā tauira rahunga rerekē i te waehere kua tuhia e te tangata.
He hē te huarahi e kitea ai tēnei āputa e te nuinga o ngā tīma, ina tae mai tētahi CVE ki te mahi hanga i tika kia mau i tā rātou matawai, ina rānei he mea ngaro commiti raro i te tukanga mahi ā-AI, ka puta ki roto i ngā ringa o te kaiwhakaeke.
| Kāore he Mana Whakahaere Motuhake a te AI | Me Xygeni | |
|---|---|---|
| Ngā ngoikoretanga o te waehere | Ngā tauira rahunga pūnaha, te matotoru teitei | I mau i te wā tuhi i roto i te IDE i mua commit |
| Te whakakitenga o ngā mea ngaro | 2x teitei ake te tere i roto i te āwhina a te AI commits | Matawai tonu + whakakorenga-aunoa puta noa i ngā paparanga katoa |
| Ngā whakawhirinakitanga kino | E whakaaro ana te AI ki ngā mōkihi kāore he tirotiro haumaru | Te kitenga pūmanawa kino i te wā whakaputa, ehara i te wā tāuta |
| Pipeline mōrea | Kāore e kitea te whanonga o ngā taputapu āpiha | Ngā tūāpapa whanonga + te kitenga i ngā āhuatanga rerekē |
| Hua | Ka kohia te nama haumarutanga i te tere o te AI | Te kapinga e taurite ana ki te tere o te whanaketanga |
He aha i kore ai e angitu te waehere i hangaia e te AI i roto i ngā tauira motuhake
I mua i te haerenga ki ngā mana whakahaere, he mea tika kia mārama he aha i rerekē ai te rahunga o te waehere i hangaia e te AI i te waehere i tuhia e te tangata, nā te mea ko ngā aratau rahunga e whakatau ana ko ēhea mana whakahaere te mea nui.
Te whakaoti tauira i runga i te whakaaro haumarutanga
Ka whakaputa waehere ngā LLM mā te matapae i ngā haere tonutanga o ngā tauira kua kitea e rātou i roto i ngā raraunga whakangungu, e ai ki te tatauranga. Ina whakaurua ki roto i aua raraunga whakangungu he miriona tauira o te waehere kore haumaru, ka tāruatia e te tauira aua tauira me te maia me te matatau.
Kāore te tauira e whakaaro ana mō te haumarutanga. Kei te whakaoti i ngā tauira. Mā te tono ki te "tāpiri i te manatoko ki tēnei pito" ka puta he waehere e āhua ana ki te manatoko, ā, he maha ngā wā ka mahi pērā i te manatoko, engari ka kore pea e pā te paunga o te tohu, ka ngaro pea ngā tirotiro whakamanatanga, ka whakamahi rānei i tētahi mea taketake kua kore e whakamahia, nā te mea he mea noa aua mea i roto i ngā raraunga whakangungu.
Te tika o te hanganga me te kore he haumaru tikanga
I te marama o Tīhema 2025, i tirotirohia e te kamupene haumarutanga a Tenzai ngā tono whakaputa 15 i hangaia mā te whakamahi i ngā taputapu waehere AI matua e rima, ā, i kitea e 69 ngā ngoikoretanga puta noa i te tauira. Kāore i ia tono te tiaki CSRF, ā, kāore he pane haumarutanga i whirihorahia. I whakauruhia e ia taputapu ngā ngoikoretanga tono taha-tūmau (SSRF), he tirohanga whānui o ngā hapa haumarutanga taketake puta noa i ngā tono 15 katoa.
Ehara ēnei i ngā āhuatanga taha. He āputa pūnaha ēnei i roto i ngā mea e arotauhia ana e ngā taputapu AI: te mahi waehere, ehara i te taunoa haumaru.
I kitea motuhaketia e Georgetown CSET ngā ngoikoretanga XSS i roto i te 86% o ngā tauira waehere i hangaia e te AI i whakamatautauria puta noa i ngā LLM matua e rima.
Te tere o te whakakitenga o ngā mea ngaro
Awhina AI commite whakaatu ana i ngā mea ngaro i te rua o te tere o te whakaatu i ngā mea ngaro e te tangata anake commitraga. Te He panui rangahau a te CSA mō te haumarutanga waehere hihiko e 3.2% te uara mō te āwhina a te AI commits vs. 1.5% mō te tangata anake, ā, i kite a GitHub tūmatanui i te pikinga 34% i ia tau mō ngā tohu tuakiri kua whakapūmautia i te tau 2025.
He māmā noa iho te tikanga: he maha ngā wā ka whakapirihia e ngā kaiwhakawhanake e mahi ana i te tere o te AI ngā tohu tuakiri ki roto i ngā tohutohu hei horopaki, ā, ka whakaurua ponotia e ngā taputapu AI aua tohu tuakiri ki roto i te putanga kua whakaputaina. Ka arotakehia e ngā kaiwhakawhanake te waehere AI i te tirotiro tere mō te tika o te mahi, ehara i te whakaaturanga ngaro.
Ngā hapa hoahoanga kāore e kitea
He tino pai ngā taputapu haumarutanga tuku iho ki te kimi i ngā tauira ngoikore e mōhiotia ana i roto i te waehere tūmau: te werohanga SQL, te XSS, te whakakorenga raupapa kore haumaru. He raru ēnei ki ngā hapa taumata-hoahoa, te ngaro o te manatoko i runga i te huarahi API katoa, te pakaru o te arorau mana uru, he tauira whakamanatanga e whakaaro ana he rere raupapa engari ka taea te karo i waho o te raupapa.
Ka nui ake ngā hapa hoahoa ka puta mai i te waehere i hangaia e te AI nā te mea ka puta mai ngā taputapu AI i te taumata āhuatanga, ehara i te taumata pūnaha. Kāore te AI e mōhio ki te tauira haumarutanga o te pūnaha e karapoti ana mēnā kāore i te mārama te horopaki, ā, kāore te nuinga o ngā kaiwhakawhanake e whakaaro ki te whakarato.
Me pēhea te tiaki i te waehere i hangaia e te AI i roto i tōu rorohiko CI/CD Pipeline
1. Whakaarohia te waehere i hangaia e te AI hei tāuru kore whakawhirinaki i te SAST paparanga
Ko te huringa whakahaere tino nui: kaua e whakaitihia SAST te kapinga nā te mea i ahu mai te waehere i tētahi AI. Me mahi te ritenga kē. Me tumanako tetahi tīma e whakamahi nui ana i te AI ka piki ake te maha o ā rātou kitenga, ā, me whirihora hoki ā rātou taputapu kia rite ki tēnā.
I roto i te mahi, ko te tikanga o tēnei ko te whakahohe i SAST i runga i ia commit, ehara i te mea ko ngā PR anake. Ka tere te whakaputa waehere a ngā taputapu AI, ā, ka taea e ngā kaiwhakawhanake te commit āta haere. Ko te tatari mō te arotake PR te tikanga ka kohia ngā kitenga i mua i te tirohanga a tetahi. Ko te tikanga hoki he whakatikatika SAST ngā paepae kaha mō ngā momo rahunga o te waehere AI: te ngaro o ngā arowhai motuhēhēnga me te whakamanatanga, SSRF, CSRF, te whakakorenga raupapatanga kore haumaru, me ngā tohu tuakiri kua whakapūmautia, ngā akomanga ngoikoretanga kāore i te tino kitea i roto i te CVSS engari ka taea tonu te whakamahi.
Ko te wero matua ko te reiti hē-pai. He tere te whakaputa a ngā taputapu AI i te maha o ngā waehere, ā, he FPR teitei hoki SAST he nui ngā kitenga ka puta, ā, ka ako ngā kaiwhakawhanake ki te kore e aro ki aua kitenga. Koinei te hihiri o te ngenge mataara e whakakorekore ana i te kaupapa o te matawai.
Xygeni SAST i whakatauritea ki te Paearu OWASP ā, i tutuki i te 100% te reiti pono pai me te 16.7% te reiti teka pai. I roto i te taiao e whakanui ana te waehere i hangaia e te AI i te rahinga rapunga, ko taua mea i muacisMā te aituā ka taea tonu te whakamahi i ngā kitenga, kaua e warewarehia. Ako atu mō Xygeni SAST →
2. Matawaihia tonutia ngā mea ngaro, kaua i te wāhi anake commit wā
Pre-commit hooks he mea tika engari kāore i te rawaka. He maha ngā wā ka karohia e ngā kaiwhakawhanake e whakamahi ana i ngā taputapu AI i te tere hooks, te whakamahi i ngā ētita AI tukutuku kāore e tautoko i a rātou, te whakaputa rānei i ngā mea ngaro i roto i ngā tuhinga CI kaua ki te waehere tono, ina hooks kaua rawa e whakaoho.
He tūnga haumarutanga ngaro katoa mō ngā hiahia whanaketanga āwhina-AI pre-commit hooks mō ngā kaiwhakawhanake e whakamahi ana i ngā taputapu AI ā-rohe, te matawai tonu i ngā repo puta noa i ngā peka katoa tae atu ki te hītori katoa commit te kapinga (ngā mea ngaro pono mai i ngā mea tawhito commitkei te taea tonu te whakamahi), pipeline te matawai rangitaki (he maha ngā wā ka whakaurua e ngā tuhinga CI i hangaia e te AI ngā tohu tuakiri hei taurangi whakauru ka tāia hei hanga rangitaki), me te whakakore aunoa ina kitea, nā te mea ko te matapihi i waenga i te whakaaturanga me te kitenga o te kaiwhakaeke ka inehia i roto i ngā hāora, ehara i te rā.
Xygeni Secrets Security kitea ai neke atu i te 800 ngā momo ngaro puta noa i ngā putunga, pipeline rakau, IaC ngā kōnae, me ngā whakaahua ipu. Ko te --history Ka whakaatuhia e te aratau matawai ngā mea ngaro kua tawhito engari kei te whai mana tonu, he āputa noa i roto i ngā rerengamahi āwhina-AI. Ka hunaia ngā mea ngaro i mua i te takiuru, i te tukunga rānei ki te tūāpapa, kia kore ai te tukanga kimi e hanga whakaaturanga hou. Ka tīmata ngā rerengamahi whakakore-aunoa ina kitea. Ako atu →
3. Taere SCA me te kimi pūmanawa kino ki ngā whakawhirinakitanga i tūtohutia e te AI
Kāore ngā taputapu waehere AI e tuhi waehere noa, engari e whakaatu ana i ngā whakawhirinakitanga. Ka whiwhi te kaiwhakawhanake e tono ana ki tētahi kaiawhina ki te "tāpiri i tētahi whare pukapuka mō te tātari JWT" i tētahi taunakitanga mōkihi he mōkihi tika pea, he mōkihi hapa hapa me te ingoa ōrite, he mōkihi tika rānei i te wā i whakangungua ai te tauira engari kua takahia i muri mai.
te Rangahau mō te ngoikore o te waehere i hangaia e te AI CSA 2025 e tuhi ana hoki i te "slopsquatting", arā, ko ngā kaiwhakaeke e rēhita ana i ngā ingoa mōkihi moemoeā i hangaia e ngā taputapu AI, ka huri tika i te tauira moemoeā hei huarahi whakaeke mekameka tuku. Standard E hangai ana ki te CVE SCA kāore e hopu i tētahi o ēnei.
Ngā mea e hiahiatia ana e koe: te kimi i ngā pūmanawa kino whanonga e tohu ana i ngā mōkihi me ngā tuhinga tāuta whakapae, ngā waeatanga whatunga ohorere, ngā waehere huna rānei; te kimi i te hapa pato me te kore e tika ana e tātari ana i te kauwhata whakawhirinakitanga katoa mō ngā mōkihi kua whakaingoatia he tinihanga; me te matawai CVE tātari-taea e wehewehe ana i ngā mahi ngoikore e karangatia ana mai i ngā mea kua kawemai engari kāore i whakatinanahia.
Xygeni SCA ka whakakotahi i te kimi pūmanawa kino i te wā tūturu mā te Whakatūpato Moata Pūmanawa Kino (MEW) miihini, te matawai npm, PyPI, Maven, NuGet, RubyGems me ētahi atu rēhita i te wā whakaputa, kaua i te wā tāutanga anake, me te Matawai Whakawhirinakitanga Whakapae e kitea ai ngā hapa pato, te pōhēhētanga whakawhirinakitanga, me ngā tuhinga tāuta whakapae mā te tātari i te kauwhata whakawhirinakitanga katoa. Tirohia te āhua o tana mahi →
4. Whakaū i te haumarutanga guardrails i roto i te pipeline, ehara i te arotake waehere anake
He puhoi rawa te arotake waehere, ā, he koretake rawa, kāore e tika ana kia waiho hei mana whakahaere haumarutanga matua mō te waehere i hangaia e te AI. Ko ngā kaiwhakawhanake e arotake ana i te putanga AI i raro i te pēhanga tere ka tirotiro tuatahi i te tika o te mahi. Ko te tika o te haumarutanga, mēnā ka tirohia, ka haere mai i muri.
Pipelinetaumata- guardrails whakatinana aunoa i ngā whakaritenga: ngā hanganga poraka e whakauru ana i ngā mea nui hou SAST ngā kitenga i runga ake i te paepae whirihora, aukati i te whakatinanatanga mēnā ka kitea he mea ngaro hou i roto i te commit, whakatinanahia te kaupapa here whakawhirinakitanga mā te aukati i ngā mōkihi e rahua ana i ngā tirotiro pūmanawa kino, kāore rānei i te piri ki tētahi whakarāpopototanga tika, ā, me hiahia SBOM te whakaputa i ngā tukunga kei roto ko te waehere āwhina-AI.
Ko te kaupapa matua o te hoahoa: guardrails me ārai, me whakatūpato rānei, kaua e ripoata noa. Ko te kitenga kāore e ārai i tetahi mea ka ako i ngā kaiwhakawhanake ka taea te wareware noa i ngā kitenga.
Xygeni DevAI he pairati haumarutanga āpiha e wātea ana hei Toronga Waehere VS a Monomai IntelliJ/JetBrains e rere haere ana i te piki haere SAST te matawai i te wā e tuhi ana ngā kaiwhakawhanake i te waehere, te whakamārama i ngā ara whakamahi mō ngā ngoikoretanga kua kitea, me te tuku i ngā whakaaro whakatika kua whakamanahia e te Xygeni MCP Server mō te mōrearea, te kaupapa here, me te pānga pakaru-huringa. Te kimi i ngā mea ngaro, SCA, a IaC Ka oma katoa ngā matawai i te wātū IDE kotahi. Ako atu →
6. Aroturukihia ngā whanonga rerekē mai i ngā taputapu waehere AI
Ngā taputapu whakahaere AI, ngā taputapu e mahi ana i ngā mahi motuhake i roto i tō taiao, ehara i te mea ko te whakaputa whakaaro anake, engari e whakauru ana i tētahi mata riri hou. He taputapu waehere kaiwhakahaere me te urunga tuhi putunga, pipeline he tino whai hua te urunga whakaoho, te urunga ngaro rānei mēnā ka takahia.
I te tīmatanga o te tau 2026, i whakaaturia te CVE-2025-54135 (CurXecute), he ngoikoretanga whakahaere waehere mamao i roto i te ētita waehere Cursor AI, i āhei ai te whakahaere waehere tūpono i runga i ngā mīhini a ngā kaiwhakawhanake me te kore he taunekeneke a te kaiwhakamahi. Te Radar Haumarutanga o Georgia Tech Vibe E kī ana ngā rangahau kei te tere haere te horapa o ngā mata whakaeke i te mea ka kaha ake te mana motuhake o ngā taputapu AI.
Te aroturuki whanonga mō ngā mahi a ngā taputapu AI i roto i tōu pipeline me tūpato ki ngā huringa ohorere CI/CD ngā kōnae whirihoranga rerengamahi (tētahi o ngā tohu mārama o tētahi taputapu AI kua takahia, he whakaeke werohanga tere rānei), ngā tukanga taputapu waehere AI e hanga ana i ngā tono whatunga ki ngā ūnga ohorere i te wā hanga, ngā tauira urunga rerekē ki ngā toa ngaro mai i ngā teihana mahi a ngā kaiwhakawhanake, me ngā whakawhirinakitanga hou i whakaurua mai e ngā taputapu AI kāore i te kitea i ngā hanga o mua.
| Apa | mana | Manakē |
|---|---|---|
| Code | SAST i runga i ia commit, whirihoranga FPR iti | Critical |
| Code | Urupare haumarutanga IDE i roto i te VS Code / IntelliJ | Tino Hāngai |
| ngaro | Pre-commit hooks + matawai repo tonu | Critical |
| ngaro | Te matawai i te hītori Git mō ngā mea ngaro tawhito whaimana | Critical |
| ngaro | Whakakorenga aunoa ina kitea | Critical |
| Ngā taunga | SCA me te pūmanawa kino me te kimi i ngā hapa | Critical |
| Ngā taunga | Te whakatauranga matua o te CVE kua tātarihia e te taea te tae atu | Tino Hāngai |
| Pipeline | Hangaia he poraka mō ngā kitenga hou | Tino Hāngai |
| Pipeline | Te whakatinanatanga o te kaupapa here whakawhirinakitanga i te wā hanga | Tino Hāngai |
| Pipeline | SBOM te whakaputa mō ngā tukunga āwhina-AI | wawaenga |
| Ngā taputapu ā-ringa | Te aroturukitanga whanonga o te mahi a ngā taputapu AI | Tino Hāngai |
| Ngā taputapu ā-ringa | Te urunga iti rawa mō ngā taputapu waehere AI | Tino Hāngai |
Me pēhea te tiaki a Xygeni i te waehere i hangaia e te AI mai i te pito ki te pito
Ko te tiaki i te waehere i hangaia e te AI me hipoki puta noa i te katoa SDLC, mai i te wā e whakaae ana te kaiwhakawhanake i tētahi whakaaro tae noa ki te wā e puta ai te taonga. Ko ngā taputapu tohu e kapi ana i te paparanga kotahi anake ka waiho ngā āputa ka kitea ponotia e te whanaketanga tere-AI.
| wāhanga | Te Pūkenga o Xygeni | Ngā mea e hopukia ana e ia |
|---|---|---|
| I roto i te IDE | Tūmau DevAI + MCP | Ngā ngoikoretanga i te wā tuhi, i mua i commit |
| At commit | SAST + Haumarutanga Ngā Mea Ngaro | Ngā hapa waehere, ngā tohu tuakiri kua whakapūmautia, ngā kī API kua kitea |
| I te hanganga | SCA me te kimi pūmanawa kino me te āheinga ki te toro atu | Ngā whakawhirinakitanga kino, ngoikore rānei e kīia ana e te AI |
| In pipeline | CI/CD Haumarutanga + Te Kitenga i ngā Āhuatanga Kāore i te Tika | Ngā hanganga kore haumaru, te takahi i ngā taputapu a te kaiwhakahaere, ngā rerengamahi kua werohia |
| Whai muri i te whakatinanatanga | DAST + ASPM | Whakamana i te whakamahinga o te wā whakahaere, te tūnga mōrearea kotahi |
Ko te mea nui e wehewehe ana ko te paparanga mōhiotanga e hono ana i ēnei katoa. Mā te Tūmau MCP a Xygeni ka arotakehia te whakaaro whakatika e whakaputaina ana e DevAI i roto i te IDE mō te tutuki i ngā kaupapa here, te mōrearea o te huringa pakaru, me te horopaki whakahaere i mua i te taenga atu ki te kaiwhakawhanake. Te whakatikatika āwhina-AI me guardrails, kaua me te mea kua weto te haumaru.
Thoughts Final
Kei te whakaputa ngā taputapu waehere AI i tētahi wāhanga nui, kei te tipu haere tonu hoki o enterprise waehere. Kei te whakauru pūnaha hoki rātou i ngā ngoikoretanga haumarutanga ki ngā tauira tino nui: te ngaro o te mana, ngā mea ngaro e kitea ana, ngā whakawhirinakitanga kore haumaru, me ngā hapa hoahoa e ngaro ana i ngā matawai tūmau.
Ehara te whakautu i te whakawhāiti i te whakamahinga o ngā taputapu AI. Engari ko te build security he hanganga e taurite ana ki te tere o te whanaketanga o te AI. Ko ngā tīma e tika ana tēnei ka tuku i ngā āhuatanga āwhina-AI tere ake, haumaru ake hoki i ngā tīma e whakamahi ana i te waehere AI pērā i te waehere tangata, engari he nui ake te tere o ngā hapa.
Ehara. Ā, ko tāu pipeline me mōhio ki te rerekētanga.
???? Tīmata to whakamātautau koreutu ā, matawaihia tō putunga raraunga tuatahi e āwhinahia ana e te AI i roto i ngā meneti, kāore he kāri nama e hiahiatia ana.
???? Tukuna he demo kia kite ai me pēhea te hono atu o Xygeni ki tō puranga whanaketanga AI motuhake.
???? Tikiakehia te pepa ma, Te Whakatakoto Waehere Hiko Haumaru i mua i te Noho hei Mōrearea AI Nui rawa atu mō tō Whakahaere.
Pānui e pā ana:
- Haumarutanga Āwhina Waehere AI: Me pēhea te ārai i ngā ngoikoretanga i roto i te waehere i hangaia e te AI
- Haumarutanga Atarangi AI: Ngā Mea Katoa e Hiahia Ana Koe kia Mōhio
- Me pēhea te whakatinana i te whakaora AI i roto i te DevSecOps
- Haumarutanga MCP: Te Tiaki i te Kawa Horopaki Tauira
- Ngā Tono LLM 10 Pai rawa atu a OWASP mō te tau 2025
Mō te Kaituhi
Kai-whakarewa me te CTO
Fatima Said he tohunga ki ngā ihirangi a te kaiwhakawhanake mō AppSec, DevSecOps, me software supply chain securityKa hurihia e ia ngā tohu haumarutanga uaua hei aratohu mārama, whai hua hoki, hei āwhina i ngā tīma ki te whakarite i ngā kaupapa matua kia tere ake, ki te whakaiti i te haruru, me te tuku waehere haumaru ake.
