Kuchengetedzwa kwezvekushandisa zveAI agent kwaimbove nyore, kunyanya nekuti munhu aigara ari pakati pezita repakeji nechimiro. Kwemakore makumi maviri, ndiyo yaive modhi yese: mumwe munhu aiverenga zita risati rapinda. Kwete nguva dzose nekungwarira. Asi mumwe munhu aiverenga.
Izvo zvapera izvozvi. Bvunza modhi yeAI yeraibhurari nhasi, uye paki imwe chete pashanu dzinokurudzirwa hadzipo. Varwi vanoziva izvi, saka vanonyoresa mazita iwayo kutanga. Mumiriri anoaisa, anoaedza, uye anoenderera mberi, uye hapana anoverenga chero chinhu pakati. Apa ndipo chaipo pari kutadza kuchengetedza kweAI agent supply chain pari zvino: kwete mune imwe mamiriro ezvinhu emangwana, asi mune pipelineiri kumhanya nhasi.
Indasitiri iyi yakapedza makore makumi maviri ichivaka zvidzoro zvemugadziri anoverenga, anoongorora, uye anosarudza. Mugadziri iyeye haasisiri nzvimbo yekupedzisira yekutarisa usati wapinda muchivako. Saka mubvunzo chaiwo hausi wekuti agent AI inounza njodzi itsva here, asi chii chinosara chakamira kana nzvimbo yekutarisa yevanhu yapera.
Kubva pa "AI Inokurudzira" kuenda ku "AI Acts"
Makore maviri apfuura, mumwe mutyairi wendege akakurudzira kodhi block, mugadziri akaiverenga, uye mugadziri akasarudza kana aizoichengeta. Mabasa iwayo haasisina zvachose. Maturusi eAgent ikozvino anoisa ma dependencies, anotenderedza ma containers, uye anokonzeresa. pipeline vanotora matanho ega, vachiwanzotaura chete mushure mekunge zvaitika, uye chete kana paine chisina kumira zvakanaka.
Kuchinja uku kwakaitika muzvikamu, uye zvikwata zvakawanda zviri kure kupfuura zvinobvumidzwa nemutemo wavo wekuchengetedza wakanyorwa. Maturusi ekutanga evamiririri aikumbira mvumo nguva dzese dzisati dzachinja, uye vagadziri vaidzvanya "hongu" kakawanda zvekuti danho rekusimbisa rakarega kureva chero chinhu. Vamiririri vemazuva ano havawanzo bvunza zvachose. Vanongopindira chete kana zviito zvichinzi zvine hungwaru, sekumhanyisa script yeshell, uye yakajairika. pull request Zvinogadzirwa nemumiririri zvinogona kuyambuka mitsara yakawanda isingaverengeki nemunhu kusvika kumagumo isati yabatanidzwa.
Dambudziko remvumo rinowedzera izvi. Mumasetup mazhinji, mumiriri anongoshanda semugadziri, aine mukana wekuwana zvese zvinogona kuwanikwa nemuchina wemugadziri: nharaunda inoshanduka, ma token egore, ma registry credentials, ma SSH keys. Kana mumiriri akaisa chimwe chinhu uye script ikapfura panguva yekuisa ikoko, inotora nzvimbo yakazara yekuputika kwemunhu waari kutevedzera. Apa ndipo apo AI agent supply chain security inorega kuva mubvunzo wemutemo uye inova mubvunzo wemvumo: mumiriri haadi chinhu chitsva, anongoda mukana waainawo kare.
Kaputeni weDocker Mohammad-Ali A'râbi, vachitaura pane rimwe boka, vakazvitaura zvakajeka: "Ndinofunga kuti mugadziri wezvirongwa izvi ari chikamu chekurwisa izvozvi."
Zvakakodzera kutaura chokwadi nezvezvakatsiva izvi. Munhu anoverenga a package.json diff yaitove isina simba rekutonga; hapana akambosimbisa kutsamira kwese kwekuchinja asati abvumidza shanduko. Vamiririri havana kutyora sisitimu yakasimba. Vakabvisa chikonzero chekupedzisira cheisina simba. Chakachinja hachisi chekuti njodzi yacho itsva, asi kuti ikozvino inofamba nekumhanya kwakasiyana zvachose: mamwe mafungidziro anoisa huwandu hwekurwisa kwechain yekugovera gore rapfuura painenge kashanu pagore rapfuura, uye curve yacho inoita kunge iri exponential kwete linear.
Nguva Yekuisa: Chii Chinochinja Kana Pasina Munhu Ari Kutarisa
Zvisizvo uye mazita emapakeji ane hukasha haasi matsva. typosquatting yave ichishandisa zvikanganiso zvekunyora kwevanhu kwemakore: bhii rimwe chete risiri iro, uye mugadziri wezvirongwa anoisa chinhu chisiri iro. Chinosiyana ikozvino ndechekuti modhi, kwete munhu, ndiye anogadzira zita pakutanga, uye rinozviita nenzira inofanotaurwa.
Nhamba idzi dzinoita kuti izvi zvive bhizinesi, kwete chinhu chinonetsa kuziva. Zvinenge 20% yemapakeji anokurudzirwa nemaodha e-open-source haapo (anosvika 5% emamodha ekutengesa), uye pamazita akadzidzwa, 43% anodzoka zvakafanana pamibvunzo gumi inodzokororwa. Kudzokororwa ikoko ndiko kunoita kuti maitiro ekurwiswa akwanise kurimwa: murwisi haafanire kufungidzira kuti mugadziri achanyora chii. Modhi yacho inovaudza, zvakavimbika, mahara.
Imwe shanduro itsva inonzi HalluSquatting inoenderera mberi. Panzvimbo pekuburitsa package ine njodzi pasi pezita rekuti "hallucinated", murwisi anoisa mirairo ine njodzi mukati meREADME, faira rehunyanzvi, kana tsananguro yeseva yeMCP, obva amirira kuti mumiririri aone zvisina musoro zita renzvimbo iyoyo kana rekushandisa obva aridhonza. Pepa razvino rakabatanidza izvi ne "prompt injection" rakaratidza kufanotaura kwakakwana kwemazita enhema enzvimbo yemapurojekiti matsva, uye kodhi yakazara ichishandiswa kurwisa vabatsiri vekodhi chaivo vanosanganisira Cursor, Windsurf, uye Copilot. Nekuti payload iri text plain pane executable code, maturusi mazhinji ekuskena haana chekuratidza.
SeXygeni Mukuru Wekutsvagisa Luis Rodríguez zviise panguva yekukurukurirana: "Takapedza makore tichivaka dziviriro kubva kukodhi yakaipa. Masaini, mabhokisi ejecha, kuongorora maitiro. HalluSquatting haidi chero chimwe cheizvozvo. Inongoda README inogutsa." Mirayiridzo isina kunyorwa zvakanaka inoverengwa nemumiririri semashoko akavimbika inodarika ma scanner akagadzirwa kuti abate chimwe chinhu chinogoneka.
Ndiwo mutsetse wezvishandiso zveAppSec zvisati zvagadzirwa kuti zvionekwe, izvo zviri pambericisehe chikonzero nei Xygeni's Yambiro Yekutanga YeMalware (MEW) Maitiro aripo padanho repuratifomu: ongororo inoenderera mberi, yenguva chaiyo yemapakeji matsva akaburitswa mumarejista akadai se npm, PyPI, uye Maven, akavakirwa kubata hunhu husina kunaka usati waisa siginecha yeruzhinji, pane kumirira kuti CVE isvike mazuva anotevera.
Midziyo, CI/CD, uye Zvinobva: Unogona Kuratidza Zviri Muchivakwa Chako Here?
Mumiriri haawanzomira kuwedzera mutsetse ku package.jsonInogadzirisa maDockerfiles, inogadzirisa kuvaka kwezvikamu zvakawanda, uye inobata pipeline configuration zvakananga, ichipinda mu build system pachayo kwete kungopinda mu source tree chete.
Apa ndipo chaipo panowanikwa mhinduro yeindasitiri kunjodzi dzekutengesa, SBOMs and SLSA provenance, yaifanira kuchengetwa. Zvadaro, muna Chivabvu 2026, mumwe murwisi akabata muchengeti wezvinhu zvisiri pamutemo, akashandisa token yakabiwa kuburitsa "nherera" commit isina mubereki munhoroondo yepurojekiti, uye vakaishandisa kusvibisa cache yekuvaka. Mapakeji akabuda, makumi masere nemana, akatumirwa aine ruzivo rwakazara, rwakasainwa zvakanaka rwepamusoro-soro. Cheki yega yega yakapasa otomatiki. Marware aive echokwadi, saka, zvehunyanzvi, mapepa airatidza kuti yakavakwa sei.
Kunzwisisa kusinganzwisisike: kubva panobva chinhu kunoratidza zvakaitwa nechinhu chakapihwa, kwete kuti chakapihwa chivimbo chakakodzera. Chenesa mashoko acho usati wavapo, uye humbowo inhoroondo yekuvimbika uye inosimbiswa yechivakwa chisina kuvimbika. Kuchengetedzwa kwezvishandiso zveAI agent hakugone kupihwa kune vamwe chete kune maturusi ehumbowo akavakirwa nyika umo munhu, kwete modhi, anosarudza zvakapinda muchivakwa.
Imwe nzira yekuderedza dambudziko iri hainyanyi kunaka asi inoshanda: nguva yekudzikama, kumirira mazuva mashoma mushure mekunge pasuru itsva yaburitswa isati yashandiswa. Zviitiko zvakawanda zvekutengesa zvinoonekwa uye zvinoziviswa mukati menguva iyoyo yekutanga, saka kunonoka kwemazuva mashanu kwaizoderedza huwandu hwemari hwakawanikwa mugore rapfuura. kurwiswa kwemhando yehonye, pasina chinhu chaicho kunze kwekunge pakarepoiacy.
Git, Ongororo, uye Kuderera kweKutarisa Kwevanhu
Kuongorora Kodhi uye commit Nhoroondo yagara ichishanda sechitsigiso chekuvimba chekuti "mumwe munhu akatarira izvi." Chitsigiso ichocho chinotanga kuzununguka kana vamiririri commit, uye zvichiwedzera kubatana, pasina munhu ari mudenderedzwa panguva yazvinoitika.
Mumiriri anoisa pasuru haasi dambudziko rekuvimba nemuvaki anokopa mhinduro yeStack Overflow, kunyangwe vese vachisiya kunyora kodhi yekutanga. Chidimbu cheStack Overflow chakanyorwa nemunhu chaiye uye chakaongororwa zvisina kurongeka kuburikidza nemavhoti ekukwidza nekudzika. Kurudziro yakagadzirwa neAI ipfungwa yekuti hapana chinhu chakawanikwa, uye mugadziri anoikopa nemaoko achiri kutarisa zita repasuru, zuva rekupedzisira rakagadziridzwa, matambudziko akavhurika. Mumiriri anoiisa haamiri chero ipi zvayo kunze kwekunge paine chimwe chinhu chakagadzirwa kuti chimire.
Ndiro dambudziko chairo rekuchinja-chinja kuruboshwe. Tsika-kuruboshwe yechinyakare inofunga kuti ndiyo inokurumidza kufamba. pipeline inyanzvi yekugadzira zvinhu inogona kudzidziswa, kukurudzirwa, uye kuongororwa. Kana chinhu chinokurumidza kufamba chiri mumiririri anozvitonga, kuchengetedza kwe "shift-left" kunofanirwa kudzoserwa kunzvimbo dzekutarisa idzo mumiririri asingagoni kutaura nezvadzo: kukanda mabhokisi, kudzora kubuda, uye mahwindo ekutonhodza, pane gwaro remutemo risingashandiswe nemunhu.
Kuchengetedzwa kweAgent AI Supply Chain: Agent Yakachengeteka Zvakadini Pipeline Chaizvoizvo Zvinoda
Kupona muboka idzva iri rehonye hakudi kuti pave nematanho mapfumbamwe akasiyana ekudzora anoshandiswa zvakakwana pazuva rekutanga. Kune timu ine zviwanikwa zvishoma, maviri anokosha kupfuura mamwe:
- Sandbox mumiririri, nguva dzose. Ishandise mu microVM kana container ine dhairekitori repurojekiti iripo chete, saka mumiririri asina nzira yekuenda kuma token, ma certificate, kana mafaira emubati. Iyi ndiyo control yakachipa iripo uye ine chikonzero chidiki chekusaita.
- Wedzera hwindo rekudzikisa usati waisa shanduro itsva dzepakeji. Mazuva mashoma anowanzo kukwana kuti kurwiswa kwezvipenyu kuoneke pachena uye kuzivikanwe kusati kwasvika pakuvaka kwako.
Chechitatu, kune zvikwata zvinogona kushanda nazvo: kuvaka CVE ne malware zvinoonekwa zvakananga mu pipeline, kuongorora mufananidzo wemudziyo (kwete kodhi yekunobva chete, sezvo zvikanganiso zvakawanda zviri mumufananidzo wekutanga) uye zvinobuda pachena se pull request Vagadziri vemakomendi vanoona mhinduro vasati vabatanidza.
Chiitiko chakaitika munguva pfupi yapfuura chinoita kuti nyaya yacho ive yakasimba. Muna Chikunguru 2026, modhi yeAI iri pasi pekuongorora mukati yakashandisa nzira ye zero-day mu sandbox yayo imwe chete inobvumidzwa network, package-cache proxy, kuti isvike pa internet yakavhurika uye, pasina munhu anoiraira, yakakanganisa zvivakwa zvekunze mukutsvaga chinangwa chekuenzanisa. Nzira yekutiza yaive dependency infrastructure: kubatana kumwe chete kwakavakirwa sandbox yega yega kuti ipinde. Kana mumiriri wako achida kusvika pa package registry kuti ashande, kubatana ikoko hakusi divi re security model yako. Ndiyo security model. Kutsanangurwa kwakazara kweXygeni kwekuti kutiza ikoko kwakaitika sei kwakakodzera kuverenga: Rogue neGadzira.
Zvitsva Zvitsva
- Nzvimbo yekupedzisira yekutarisa vanhu iri kunyangarika, kwete kupera simba. Kudzora magadzirirwo asingatsamiri pakuverenga zita repakeji.
- Kugara uchingodya zvidimbu (slopsquatting) uye kurara uchingofunga nezvezvinhu zvisina basa (HalluSquatting) zvinorimwa, kwete zvekufungidzira. Mazita anodzokorora anowanzoonekwa uye kuiswa kwemishonga isina kujeka zviri kutoshandiswa musango.
- Kubva uye SBOMzvinoratidza zvakaitwa nechivakwa, kwete zvachakapihwa. Shandisa humbowo hwepamusoro-soro sezvinodiwa, kwete zvakakwana.
- Kudzivirira, kwete kuona, ndiko kuri kukonzera dambudziko parizvino. Kutamba nebhokisi resandbox, kudzora kubuda, uye mahwindo ekudzikisa ruzha zvinotenga nguva iyo scanning inotarirwa nechiratidzo.
- Nyora zvinhu zvinogona kuwanikwa nevamiririri vako. Kwete gwaro remutemo. Matokeni chaiwo, zvitupa zvechokwadi, kubuda kwenetwork chaiyo.
Chinyorwa ichi chinobva pahurukuro kubva kuXygeni's SafeDev Talk “Kana maAI Agents akaisa maDependencies,” ichiratidza Captain Mohammad-Ali A'râbi. Hurongwa hwake hwese hwekugadzirisa hutachiona hwe nine-control hunotsanangurwa zvakadzama mutsamba yake yenhau, Docker Security Dispatch naLuis Rodriguez Research Officer kuXygeni.
Mibvunzo Inowanzo bvunzwa: Kuchengetedzwa kweAgent AI Supply Chain
Ko mumiririri kuisa pasuru idambudziko rekuvimba rakasiyana zvachose neremugadziri ari kukopa zano reStack Overflow, kana kuti ingori vhezheni inokurumidza yeimwe chete?
Zvese zviri zviviri, muzvikamu zvakasiyana. Maitiro acho anokurumidza, asi musiyano wekuvimbana wakakurawo muchimiro: mhinduro yeStack Overflow yakanyorwa uye yakaongororwa zvisina kurongeka nemunhu, nepo kurudziro yepakeji yakagadzirwa neAI iri mukana wekuti pave neongororo isina ongororo yakaenzana, uye mugadziri anoikopa nemaoko achiri kushandisa kuongororwa kwakajairika asi mumiriri asina kutarisirwa anodarika zvachose.
Zvingadii kuti SBOM kunyora zvakavimbika "mumiriri akawedzera izvi, uye heino chikonzero"?
Nhasi SBOM uye mavambo standards dzakavakirwa pafungidziro yekuti munhu aivimba necision, uye havasati vava nemunda wekuti ndeupi mumiririri, ndeupi modeli, kana kuti ndeupi mumiririri wakagadzira shanduko. Kuvhara mukaha iwoyo kunoda kuwedzerwa kune mafomati aripo ekusimbisa kana nzira yakasiyana, inozivikanwa nemumiririri inotora decision provenance pamwe chete nebuild provenance.
Pane here shanduro ye "shift-left" ichiri kushanda kana chinhu chinokurumidza kupfuura zvese mu pipeline mumiriri anozvimirira ega, kwete mugadziri wezvinhu?
Ehe, asi inofanira kuchinja nzvimbo yekutarisa, kwete nguva chete. Kuchinja-chinja kubva kuruboshwe zvichienda kuruboshwe hakuenderane nekumhanya kwemushandisi; kuchinja-chinja kubva kuruboshwe zvichienda kuruboshwe zvichienda kune sandboxing, zvirambidzo zvekubuda, uye kuisa ma cooldown zvinogona kubata mushandisi asina kugadzikana asati asvika pakugadzirwa, nekuti kudzora ikoko hakutsamiri pane chero munhu ari kuverenga chero chinhu.
