Ehara i te mea ko ngā kaimahi anake e whakamahi ana i tētahi karetao kōrerorero kāore i whakaaetia te Shadow AI. I ēnei rā, atarangi AI maha ngā ngā kaihoko AI kāore i whakaaetia e rere ana me ngā whakaaetanga tūturu: urunga repo, CI/CD ngā tohu, te pānui/tuhi kōnae, me ngā API karere. Arā, ka taea e te atarangi AI te mahi pēnei aunoatanga atarangi, ā, koia te take e tere ake ai te whakanui ake i te mōrearea haumarutanga i tā te nuinga o ngā tīma e whakaaro nei.
Anei te āputa haumarutanga: ka whakawhanui te shadow AI i tō mata whakaeke me te kore e whakarerekē i ō mana whakahaere. Hei tauira, ka taea e tētahi kaihoko te horomi i ngā ihirangi kāore i te pono, te whai i ngā tohutohu huna, kātahi ka waea atu ki ngā taputapu e pā ana ki ngā pūnaha whakaputa. Nō reira, ehara i te mea ko te turuturu raraunga anake te mōrearea; engari ko te ngā mahi kāore i whakamanahia ka mahia i te tere o te mīhini.
Mena kei te hiahia koe i tētahi whakamāramatanga whai hua, ka taea e koe te whakahua i roto: Ko te Shadow AI he pūmanawa AI e whakamahia ana, kāore he mana whakahaere, e taea ai te uru atu ki ngā raraunga tairongo, te whakahohe rānei i ngā mahi tūturu. Nō reira, ehara te whakautu tika i te "aukati i te AI." Engari, me mārama te tirohanga, me iti te mana, me whakahaere pūkenga, me arotake taputapu hei whakahaere i te AI atarangi me te kore e whakaroa i te tuku.
He aha te Shadow AI?
Ko te Shadow AI he whakamahinga o ngā taputapu AI, ngā tauira, ngā rerengamahi a te kaihoko rānei kāore he whakaaetanga ōkawa, he aroturukitanga, he whakahaere rānei nā te hangarau mōhiohio, nā te haumarutanga rānei. Kei roto i tēnā ko ngā karetao kōrerorero kāore i whakaaetia, ngā toronga tirotiro, ngā kaiurungi IDE, me ngā kaihoko ā-rohe, ā-hautū rānei e hono ana ki enterprise ngā taputapu. Ko te mea nui, ka hangaia e te atarangi AI ngā wāhi matapo i roto i te whakahaere raraunga, te whakahaere urunga, me te arotakenga. Nō reira, ka taea e ia te huri i ngā mahi a ngā kaiwhakawhanake noa hei mōrearea haumarutanga me te tutuki i ngā ture.
Atarangi AI vs Atarangi IT vs Atarangi AI Agentic
E taupatupatu ana te Shadow AI ki te Shadow IT, engari he rerekē tana whanonga. Engari, ka taea e ngā pūnaha AI te ako mai i ngā whakaurunga a tauine ocisions, i te mea ka taea hoki e ngā kaihoko whakahaere i ngā mahi mā roto i ngā taputapu me ngā tohu. Nō reira, me mārama ake te tauira a ngā tīma mō tā rātou e tiaki nei.
| ahu | Kōruru IT | Atarangi AI | Atarangi Āpiha AI |
|---|---|---|---|
| He aha te mea | Pūmanawa, ratonga rānei kāore i whakaaetia | Ngā taputapu AI kāore i whakaaetia e whakamahia ana mō te mahi | Ngā āpiha AI kāore i whakaaetia e taea te karanga i ngā taputapu me te whakahaere i ngā mahi |
| Tauira noa | SaaS kāore i whakaaetia, monomai, tuhinga | Kawe kōrerorero whaiaro, ētita AI rānei e whakamahia ana me ngā raraunga kamupene | Kaihoko e hono ana ki ngā repo, CI/CD, īmēra, tīkiti, API kapua |
| mōrea matua | Te whakawāteatanga raraunga, ngā āputa ture, te urunga kore whakahaere | Te turuturu raraunga, te karo i ngā kaupapa here, te whakamahinga tauira kāore i aroturukihia | Ngā mahi kore whakamanatanga, te whakamahi hē i ngā mana, te tango i te wai i raro i te taputapu |
| Tere mōrearea | He āhua | tata | Tino tere (aunoatanga + tohu) |
| Ngā ara whakaeke | Te whakamahi hē i ngā tohu tuakiri, ngā whirihoranga kore haumaru, te whakamahi hē i te OAuth | Werohanga tere, takiuru tere tairongo, take pupuri raraunga | Werohanga taputapu, mekameka tuku pūkenga, tangohanga tirotiro-ki-rohe, hurihanga tohu |
| Te wero tirohanga | Ngā taupānga atarangi me ngā kaihoko kāore i te mōhiotia | Te whakamahinga o te AI kāore i te mōhiotia + ngā rerenga raraunga kāore i te mārama | Te whakamahinga o te AI kāore i te mōhiotia + ngā karangatanga taputapu huna + te tohu kore mārama |
| Te mana whakahaere tuatahi pai rawa atu | Te kimi SaaS + te whakahaere urunga | Putumōhiotanga AI kua whakaaetia + ngā ture whakatika + takiuru | Rarangi kaihoko + mana iti rawa + takiuru waea taputapu |
| He aha te āhua o te "pai" | Putumōhio kua whakaaetia, SSO, takiuru, arotake kaihoko | Putumōhiotanga AI kua whakaaetia, ngā mana pupuri, te whakahaere raraunga haumaru | Te wā whakahaere a te kaihoko kua whakaaetia, ngā pūkenga kua whakarārangihia kia whakaaetia, ngā tohu kua tirohia, ngā mahi kua arotakehia |
He aha te hiranga o ngā mōrearea a te OpenClaw Agent ki a DevSecOps
He mea nui te mōrearea o te kaihoko OpenClaw nā te mea ka hurihia e ngā kaihoko te tauira haumarutanga mai i te "raraunga ki roto, tuhinga ki waho" ki raraunga ki roto, mahi ki waho. I roto i te atarangi AI i roto i te horopaki, ko te tikanga ka taea e te kaiwhakawhanake kotahi te whakahaere i tētahi kaihoko kāore i te whakahaerehia e hono ana ki ngā repo, CI/CD, ngā API kapua, me ngā taputapu karere. Nā reira, ka huri te atarangi AI hei aunoatanga atarangi me ngā tohu tuakiri.
Ka pakaruhia e taua panonitanga ngā whakaaro noa. Hei tauira, he maha ngā wā ka whakaarohia e ngā tīma ngā "kaihokohoko ā-rohe" he iti te mōrearea nā te mea ka whakahaerehia e rātou i runga i te pona, ka herea rānei ki te localhost. Heoi, e whakaatu ana ngā aituā OpenClaw tata nei ka taea e te pūtirotiro te noho hei piriti, ka taea te whakaatu i ngā tohu, ā, ka taea te tango i ngā kēti taputapu, ahakoa i roto i ngā tatūnga "ā-rohe-anake".
Hei whakarāpopototanga, ina taea e te kaihoko te karanga i ngā taputapu, me whakauru i roto i tō tauira mōrearea te tahae tohu, te whakamahi kino i ngā taputapu, te whakararuraru i te mekameka tuku pūkenga, me te werohanga ā-koreKi te kore, ka ngaro i a koe te wāhanga tino mōrearea o te Shadow AI.
Ngā aituā OpenClaw tino kino (kua whakaūtia)
1) CVE-2026-25253 — Ara tango-1-Pāwhiri / ara RCE mā te hononga kino
Pānga: Te mōrahi (tūponotanga nui + pānga nui)
Ngā mea i whakahohea e ia (taumata teitei):
- Ka taea e OpenClaw te whiwhi i tētahi
gatewayUrlmai i tētahi aho patai, ā, ka whakatuwhera aunoa i tētahi hononga WebSocket me te kore e akiakihia, te tuku uara tohu i roto i te tukanga. - Ka taea e taua whakaaturanga tohu te whakahohe te tango i te kuwaha me te tukino i raro iho i runga i ngā whakaaetanga me te whirihoranga.
He aha i tino kino ai:
Ka hurihia te "pāwhiri i te hononga" hei "whakahekenga mekameka taputapu kaihoko," koinei tonu te āhua o te atarangi AI aunoatanga atarangi me ngā tohu tuakiri.
2) ClawJacked — paetukutuku taraiwa-mā-roto → localhost WebSocket brute force → te kahakina o te kaihoko katoa
Pānga: Tino teitei (tauira wahangu + tauira tauine)
Ngā mea i whakahohea e ia (taumata teitei):
Ka taea e tētahi paetukutuku kino te whakatuwhera i tētahi hononga WebSocket ki localhost ā, ka arotahi ki te ratonga ā-rohe a OpenClaw.
Mā te ngoikore o te mana whakamana kupuhipa, ka taea e ngā kaiwhakaeke te whakamahi kino i te kupuhipa me te whiwhi urunga pono, ka taea ai mana katoa o te tauira o te kaihoko.
He aha i tino kino ai:
Ka takahia te whakaaro "he haumaru te localhost". I roto i te mahi, ka noho te pūtirotiro hei piriti, nō reira ehara te "ā-rohe anake" i te rohe tūturu.
3) Te tukino i te pūnaha pūkenga: Ngā Pūkenga ToxicSkills + ngā pūkenga kino a ClawHub (mekameka tuku pūkenga kaihoko)
Pānga: Teitei ki te mōrahi (tauine + pumau)
Ngā mea i whakahohea e ia (taumata teitei):
Kino, ngoikore rānei pūkenga ka taea te whanonga pērā i ngā whakawhirinakitanga: ka tāutahia mai i tētahi mākete, ka whakahoutia motuhake, ā, he maha ngā wā ka whakahaerehia me ngā whakaaetanga taumata-āpiha.
Te tātari rangahau motuhake 3,984 ngā pūkenga kaihoko i kitea 13.4% (534) i pāngia e tētahi raruraru nui, tae atu ki te tohatoha o ngā pūmanawa kino, te werohanga tere, me ngā mea ngaro kua hurahia.
Nga tauira o te ao e whakaatu ana i ngā kaiwhakaeke e tuku ana i ngā "pūkenga" kaupapa crypto hei pana i te pūmanawa kino, hei tahae rānei i ngā raraunga tairongo mā te hangarau pāpori me ngā whakahau huna.
He aha i tino kino ai:
He mōrearea mekameka tuku tēnei, engari mō ngā kaihoko: ka taea e te "pūkenga" te tuku iho i te kaha o te kaihoko ki te pānui i ngā kōnae, te uru atu ki ngā mea ngaro, te whakahaere rānei i ngā mahi taputapu.
| Te take | Momo whakaeke | Whakawhanaunga Kaiwhakamahi | Te hua tuatahi | Rauemi |
|---|---|---|---|---|
| CVE-2026-25253 | Hononga kino → aho-uiui gatewayUrl → whakaaturanga tohu → te tango i te kuwaha / te ara RCE | Pāwhiri-1 (UI:R) | Te takahi i te kuwaha; te whakatinanatanga pea i raro iho i runga i ngā whakaaetanga | NVD (NIST) INCIBE-CERT Ko te News Hacker |
| Maikuku-Jacked | Pae taraiwa-mā-roto → localhost WebSocket → kaha rawa → tahae a te kaihoko | Tirohia tētahi pae | Te tango katoa i te mana o te kaihoko ā-rohe; te urunga ki te takiuru/whiringa/raraunga | Haumarutanga Oasis TechRadar Ko te News Hacker |
| Ngā Pūkenga ToxicSkills / ngā pūkenga ClawHub kino | Te mākete pūkenga hei mekameka tuku (pūmanawa kino, werohanga, whakaaturanga mea ngaro) | Taurangi (pūkenga tāuta/whakamahi) | Te takahi i te taumata-kaihoko mā roto i ngā whakaaetanga tuku iho me ngā whanonga pūkenga kino | Tom's Hardware Ko te News Hacker |
Tauira whakamahi: te whakaiti i te mōrearea o te Shadow AI momo-OpenClaw me te rerengamahi DevSecOps
He tauira ako whai hua a OpenClaw nā te mea e whakaatu ana me pēhea atarangi AI ka noho hei mōrearea whakahaere tūturu: ka rere "ā-rohe" te kaihoko, ka hono atu ki ngā repo me pipelines, ā, ka huri ohorere te toro atu ki te pūtirotiro, ki te tohu, ki te pūkenga tuatoru rānei hei tango mana. Ehara i te mea ko te aukati i ngā kaihoko te whāinga. Engari, ko te whakarite kia rere te mahi a te kaihoko mā roto i ngā mana whakahaere kotahi e whakawhirinakihia ana e koe mō te waehere me te mekameka tuku.
Hipanga 1: Whakaarohia ngā "pūkenga" a te kaihoko he rite ki ngā whakawhirinakitanga noa iho, kaua e rite ki ngā tāpiri-ake kinokore
Ko te nuinga o ngā aituā o te AI atarangi kāore e tīmata me tētahi whakamahinga matatau. Ka tīmata me te tango: ka tāutahia e te kaiwhakawhanake tētahi kaihoko, ka tāpirihia ētahi pūkenga, ka hoatu he urunga "kia mahi ai." Mai i taua wā, ka rite te pūnaha kaihoko ki tētahi pūnaha mōkihi: ka whakahoutia ngā pūkenga, ka puta ngā tuhinga āwhina, ā, ka taea e te waehere kāore i te whakawhirinaki te tomo puku.
Nā reira, ko te mahi tuatahi ko te whakarerekē i te whakaaro: ko ngā mea katoa ka taea e te kaihoko te tāuta, te whakahaere rānei, he wāhanga o tō mekameka tuku. I roto i te Te reremahi o Xygeni, ko te tikanga kāore koe e tatari mō tētahi pūrongo takahi. Ka arotahi koe ki ngā tohu o mua e whakaatu ana he morearea, he kino rānei tētahi wāhanga, nō reira ka mutu te whakamahinga i mua i te horapa puta noa i ngā repo me ngā mīhini kaiwhakawhanake.
He aha ngā huringa i roto i te mahi
- Ka mutu te tārua-whakapiri a ngā tīma i ngā "whirihoranga kaihoko mahi" me te kore arotake
- Ka rite te mahi ki te whakauru i ngā pūkenga hou me ngā āwhina ki te whakawhirinaki ki tētahi atu, ehara i te mea he taputapu whaiaro.
Hipanga 2: Me waiho ngā PR hei pūwāhi whakahaere, ahakoa i tuhia te huringa e te kaihoko
Ka whakaterea e ngā kaihoko te huringa. Koinei te kaupapa. Heoi, e whakaatu ana te kōrero OpenClaw i te tere o te hurihanga o ngā "huringa iti" hei kaupapa haumarutanga ina uru mai ngā tohu me ngā keti taputapu. Nō reira, kāore e ranea te whakawhirinaki ki te "tūpato a te kaiwhakawhanake".
Engari, ka puta te putanga a te kaihoko huarahi mā roto i pull requests ā, whakamanahia te matawai i te wā PR. Pērā ai, ahakoa ka whakaarohia e te kaihoko he whakatikatika whakawhirinakitanga, he whakarerekētanga tuhinga hanga, he whakatika rerengamahi CI rānei, ka noho te PR hei pūwāhi aukati i te wā e whakamahia ai te kaupapa here. Ka uru māori a Xygeni ki konei nā te mea he hanga mo CI/CD me ngā rerengamahi PR, kia mau ai ngā huringa mōrearea i mua i te hanumitanga.
Ngā huringa noa e whakahaerehia ana e te kaihoko e hiahia ana koe kia āraia
- Ngā whakahoutanga whakawhirinakitanga me te hurihanga kōnae maukati
- Hangaia ngā tuhinga me te tāuta hooks
- Ngā whakatikanga rerengamahi CI (ngā whakaaetanga, te whakamahinga o ngā mea ngaro, ngā waeatanga whatunga)
- Ngā mahi aunoatanga hou e whakahaerehia ana me ngā mana teitei ake
Hipanga 3: Whakaritea ngā mea ka whakamahia e ngā kaiwhakaeke, kaua ko ngā mea anake ka kitea e ngā matawai
Ka whakanui ake te nui o te raraunga i te Shadow AI. Ko te nui ake o te aunoatanga he nui ake te rerekētanga o te whakawhirinakitanga, te hurihanga whirihoranga, me ngā "huringa iti" ia wiki. Nō reira, ka toremi pea ngā tīma i roto i ngā kitenga mēnā kāore te kaupapa matua e hono ki te whakamahinga tūturu.
Koinei te hiranga o te horopaki whakamahi. Mena ka whakamahia pea tētahi take, ā, kāore tētahi atu, me whakaata taua rerekētanga i roto i tō tukanga mahi. Nā Xygeni huarahi whakatau kaupapa matua kua hangaia mō tēnei ao tūturu: te whakaiti i te haruru mā te arotahi ki te whakatikatika i ngā mea e tino whai tikanga ana i roto i te mahi.
He ture māmā hei whakatau i te tauine
- Āraia, terehia rānei ngā whakatikatika mō ngā take e nui rawa ana te mōrearea o te ao tūturu
- Whakaroahia te haruru iti o te tohu kia noho haumaru ai ngā kaipuke a ngā miihini
Hipanga 4: Kati te whakaaro "he haumaru te localhost"
He akoranga te mahi a ClawJacked nā te mea ka whakaekea e ia tētahi whakaaro e mau tonu ana i te nuinga o ngā tīma: "ki te mea he ā-rohe, kāore he aha." Ko te mea pono, me whai whakaaro tonu ngā kuwaha ā-rohe me ngā atanga kaiwhakamahi ā-rohe ki te taumata whakaputa. Ko te pūtirotiro he wāhanga o te mata o te riri, ā, ehara te "ā-rohe anake" i te rohe ka taea e koe te whakawhirinaki atu.
Nō reira ka whakapakeke koe i ngā ratonga ā-rohe pērā i tāu e whakapakeke ai i tētahi atanga tairongo:
- He manatoko kaha (ehara i te kupuhipa i whiriwhiria e te tangata anake)
- Ngā herenga reiti me ngā rāhui
- Kāore he whanonga hono-aunoa e whakawhirinaki ana ki ngā tāurunga kāore i manatokohia
- Whakawhāitihia ko wai ka taea te hono atu, ā, nō hea mai
Ahakoa ehara a Xygeni i te pareārai ā-rohe, ka āwhina i te whakaiti i te pānga mahi o ngā tauira "takahi ā-rohe" mā te neke i te whakamana ki te pipeline me te tūāpapa. Ina noho ngā mana whakahaere i roto CI/CD a ngā kaupapa here tū haumaru, kāore pea te atarangi AI e karo i a rātou "nā te mea nō te rohe."
Hipanga 5: Kia mataara ki ngā whanonga rerekē e rite ana ki te tukino i te mekameka tuku
He rite tonu te momo rahunga o ngā aituā momo OpenClaw: ka huri marie tetahi mea, kātahi ka tīmata te whanonga rerekē o ngā rerengamahi. Koia te take he mea nui ngā tohu e aro ana ki ngā āhuatanga rerekē. Mena ka tīmata ohorere te taiao ki te tango i ngā whakawhirinakitanga rerekē, te whakaputa tere i ngā putanga, te whakaatu rānei i ngā tauira e rite ana ki te tukino i te mekameka tuku, me tohu wawe koe i tēnā.
Te kitenga i te rerekētanga o Xygeni ā, ko te whakatakoto whakatūpato mōata e hangai ana ki taua whāinga: te whakaatu wawe i ngā tauira whakapae, i mua i te hurihanga hei aituā anō puta noa i ngā tīma.
Ngā tohu e tika ana kia whakatūpatohia
- Ngā pikinga ohorere o ngā huringa whakawhirinakitanga puta noa i ngā repo
- Ngā mōkihi/pūkenga hou he iti te rongonui, he tauira whakahou rerekē rānei
- Ngā mahi CI ohorere e tango ana i ngā wā whakahaere, e whakahaere ana rānei i ngā tuhinga
- Ngā waea whatunga rerekē mai i ngā horopaki hanga
Ko te takeaway
Kāore tēnei rerenga mahi i te "motuhake ki te kaihoko". He tauira DevSecOps e mahi ana mō te AI atarangi i te tauine: te whakahaere i ngā pūkenga pēnei i ngā whakawhirinakitanga, te huri i te kuaha i te wā PR/CI, te whakatau i ngā mea ka taea te whakamahi, te whakamutu i te whakawhirinaki ki te localhost mā te taunoa, me te kite wawe i ngā whanonga mekameka tuku rerekē. Koinei te huarahi e whakaiti ai koe atarangi AI mōrearea me te kore e whakaroa i te tuku.
Haumarutanga Atarangi AI: He aha te tikanga o tēnei mō ngā Tīma DevSecOps
Kāore te Shadow AI e waiho hei take taha noa iho. I te tau 2026, ka nui haere te tikanga ngā kaihoko me ngā whakaaetanga tūturu, e huri ana i ngā hapa ngāwari hei aituā e ahu mai ana i ngā taputapu. Ko OpenClaw te whakamaumahara mārama rawa atu: ehara i te mea ko te "kōrero" a te tauira anake te mōrearea, engari ko te mea ka taea e te kaihoko do me ngā tohu, ngā kuaha, me ngā pūkenga.
Nō reira, ko te urupare tino whai hua ko te mahi ā-tinana, ehara i te ariā. Me whakaaro ki ngā pūkenga o te kaihoko pēnei i ngā whakawhirinakitanga, ngā putanga o te kaihoko huarahi mā te PR me CI/CD guardrails, ā, kati te whakaaro "he haumaru te localhost." I taua wā anō, whakaritea ngā mea ka taea te whakamahi kia taea ai e ngā tīma te tuku tonu me te kore e toremi i te haruru.
Hei whakamutunga, kāore koe e hiahia ki te aukati i ngā kaihoko ki te whakahaere haumarutanga AI atarangiMe whakarite kia kore e taea e ngā rerengamahi e whakahaerehia ana e te kaihoko te karo i ngā mana whakahaere mekameka tuku me te tuku kua tiakina kētia tō huringa ora pūmanawa.
