Kwemakore mashoma apfuura, kuchengetedzeka kweapplication kwaive nemuganhu wakajeka: nzvimbo yekuchengetedza uye pipelineNdipo paive nemidziyo yekudzora, paimhanya scans, apo mapoka aisarudza kana chimwe chinhu chakatumirwa kuproduction. Zvese zvaitsamira pafungidziro imwe chete: mugadziri akasarudza pachena kuti ndeipi kodhi uye ndeapi madhiraivha akapinda musystem.
Fungidziro iyoyo haichashandi. Nhamba iri kukura yekodhi nhasi inonyorwa, inokurudzirwa, kana kuiswa nemumiriri weAI, kazhinji pasina munhu anotarisa zita rezviri kudhonzwa. Kana decisKuonekwa kwechinhu chinopinda mukodhi kunofambawo, uye kurwisa kunofambawo. Kunofamba kuenda kumberi kwemaitiro acho: panguva iyo kodhi inogadzirwa, mukati memubatsiri wayo uye mumafaira anoigadzirisa.
Iyi ndiyo nzvimbo yako yekurwiswa kweAI: modhi yega yega, mumiririri, sevha yeMCP, hunyanzvi, uye kuvimba kunokurudzirwa neAI izvo zvinogona kuunza njodzi munhu asati amboiongorora. Iyo AI imwecheteyo iyo vagadziri vako vanovimba nayo ikozvino chikamu chayo. Iyi haisi njodzi yeramangwana. Ishanduko yatoitika, uye heino maitiro ayo mukuita.
Kurwiswa kukuru, kwete chiitiko chimwe chete
Hapana chimwe chezvinotevera chiri murabhoritariciskana kuti fungidziro. Izvi zviitiko zveveruzhinji, zvakanyorwa, zvinenge zvese zvegore rapfuura, uye chimwe nechimwe chinosvika pedyo zvishoma nemumiriri weAI pachake:
- Nyamavhuvhu 2025, s1ngularity: Varwisi vakaba token yekuburitsa kubva kuNx, imwe yemasisitimu ekuvaka anoshandiswa zvakanyanya, uye vakasundira shanduro dzakashata kuNpm, vachishandisa maturusi eAI kutsvaga zvakavanzika pamichina yevagadziri.
- Gunyana 2025, choko/debug: imwe yemakambani makuru eNpm kuburikidza nereach, mapakeji gumi nemasere ane madhawunirodha anopfuura mabhiriyoni maviri pavhiki, akatorwa kuburikidza nekubiwa kweakaundi yemugadziri mumwe chete.
- Gunyana 2025, Shai-Hulud: imwe yehonye dzekutanga dzakanyorwa dzakakwanisa kuzviparadzira kuburikidza ne npm. Mafungu ayo echipiri, muna Mbudzi, aive akasimba uye akabatana nezvakavanzika zvakafumurwa munzvimbo dzinopfuura 25,000.
- Gumiguru 2025, zvinhu zvinopinzwa munyika zvisina kushandiswa: chikamu chemushandirapamwe wePhantomRaven, uko AI inoona zvinhu zvisipo yakaunza malware chaiyo mu npm kuburikidza nehunyanzvi hwe slopsquatting.
- Gore rino, ClawHub: rejista yehunyanzvi hweAI ine chepfu uko hushanu hwehunyanzvi hunomwe hwakanyanya kudhawunirodhwa hwaive malware.
Indasitiri iyi iri kugadzira mhedziso imwe chete. OWASP Top 10 yeLLM Applications inoisa jekiseni nekukurumidza panhamba yekutanga. OWASP MCP Top 10 (iri mu beta parizvino) inotarisa ma protocol agents anoshandisa kutaura nemidziyo. OWASP Agenic Skills Top 10, chirongwa chitsva cheIncubator-stage, chinodudza hunyanzvi hune njodzi huru. OWASP inowanzo famba nokungwarira; ichivhura mativi matatu panguva imwe chete, rimwe rawo nekukurumidzira, rinotaura chimwe chinhu nezvekuti izvi zviri kufamba nekukurumidza sei.
Zvese zvitatu zvinosangana papfungwa imwe chete: mirairo, maturusi, uye magadzirirwo akatenderedza modhi ikozvino chikamu cheAI attack surface, uye zvinowanzogara mukati me repository yako. Izvi zvinomutsa mubvunzo wekutanga wakakodzera kubvunzwa nechikwata chako: ndiani anoongorora mafaira emitemo, hunyanzvi, uye magadzirirwo eMCP anogara mu repo yako?
Vector 1: hunyanzvi hwehupfu
Unyanzvi ifaira rine mirairo nehunyanzvi hunodzidzisa mumiriri weAI maitiro ekuita basa. Haisi iyo yega nzira yekugadzirisa maitiro emumiriri (mitemo, mafaira, hooks, uye MCP configs dzinoita zvimwe chete), asi dzese dzine pfuma imwe chete: dzinofamba mukati me repository, nekodhi.
Tsvakurudzo gore rino yakaongorora hunyanzvi uhu hunosvika 4,000:
- 36% vaive nekanganiso kamwe chete pakuchengetedza.
- 13.4% vaive vakakomba.
- Vanoda kusvika zana vaive nemhosva huru.
Chinjo huru: murwisi haachanangi kodhi yako. Vanotarisa mumiririri anonyora kodhi yako, vachiisa mirairo yakavanzika (dzimwe nguva vachishandisa mavara asingaonekwe) ayo modhi inoverenga uye inoita seyakashanda. Muongorori wemunhu anotendera pull request nekutenda kwakanaka nekuti, sekuona kwavo, faira racho rinotaridzika rakachena. Muenzaniso uyu unodudzira mirairo iyo muongorori asina kumbobvira aona.
Izvi hazvisi zvekufungidzira. CVE-2025-59536 (CVSS 8.7) yakabvumira kuburitswa kweClaude Code kubva panzvimbo isina kuvimbika, uko gadziriro yakaipa yaigona kumhanyisa mirairo mushandisi asati agamuchira dialog yekuvimba. Imwe nhanho yechipiri, CVE-2026-21852, yakabvumira kuburitswa kwekiyi yeAPI kuburikidza negadziriro inodzorwa nepurojekiti, pasina mushandisi kubvumidza chero chinhu.
H2: Vekitari 2: kusvetuka-svetuka
Zita iri rinobatanidza "slop" (marara anowanzogadzirwa neAI) ne "typosquatting attack". Typosquatting inoenderana nekukanganisa kwevanhu: murwisi anonyora zita repakeji riri pedyo nerakakurumbira uye anomirira kuti pave netypo. Hazvina kurongeka.
Kukwenya kwetsoka haamiriri kuti pave nekukanganisa. Muchidzidzo chataurwa panguva yechikamu chino, 19.7% yezvinyorwa zvepakeji zvakagadzirwa nemamodeli eAI zvairatidza mapakeji asipo. Mamodheru anowanzo fungidzira mazita akafanana kakawanda, saka murwisi anoona mazita eAI anogadzira, onyora mazita iwayo nekodhi yakaipa, uye omirira kuiswa kunotevera kwakakurudzirwa neAI kuti kuiise muapp yako.
Chiyero chacho hachisi chidiki: Mapakeji matsva anodarika 450,000 ane njodzi akawanikwa muna 2025. Mienzaniso miviri inoita kuti zvive zvechokwadi:
- Muongorori akadyara pasuru yekuyedza isina njodzi inonzi kumbundirana-cli kuratidza pfungwa yacho. Yakanyorwa kudhawunirodha zvinhu zvinopfuura 30,000 mumwedzi mitatu.
- zvinhu zvinopinzwa zvisina kushandiswa, kubva pane zvakaratidzwa pamusoro apa, yakasimbiswa kuti ine malware, iri mubazi reveruzhinji, uchishandisa nzira iyi chaiyo. Iyoyo yakanga isiri bvunzo.
Mubvunzo hausi wekuti izvi zvingaitika kuchikwata chako here. Inyaya yekuti mangani mapakeji ane mazano eAI ari kuisa kodhi yako nhasi pasina anoatarisa.
Mhinduro: standardvari kubata
Masimba maviri anomhanya akatarisana. Kurwiswa uku kuchikurumidza, standardmiviri yemuviri iri kuita zvinotevera:
- NIST SP 800-218A inowedzera hurongwa hwakachengeteka hwekugadzira software nemaitiro akanangana nemamodeli eAI, kusanganisira humbowo hwekuvimbika uye kwakabva.
- In May 2026, CISA nevanodyidzana nayo pasi rose veG7 yakaburitsa gwara pamusoro peSoftware Bill of Materials yeAI, ichitsanangura zviri muinventory iyoyo: mamodheru, madatasets, zvikamu, vanopa, uye zvinoenderana.
Nzira yacho yakajeka: iyo SBOM iri kuwedzera kuita AI-BOM. Haugone kupupura kana kupupura zvausingakwanise kuisa mudura rezvinhu. Uye nhasi, masangano mazhinji haakwanise:
- 43% havakwanise kuongorora kana kuronga maturusi eAI avari kutoshandisa.
- 79% havaonekwe nevamiririri veAI uye masisitimu eMCP ari kushanda munzvimbo dzavo.
Munzvimbo dzakarongwa, zvinhu izvi zviri kubva pakushanda zvakanaka kuenda pakutarisira kwechibvumirano kana kuti kutevedzera mitemo. Asi zvinhu zviri muchikamu chinongokuudza zvaunazvo. Chega, hazvidziviriri kurwiswa.
Musiyano: EDR yeAppSec
SAST uye SCA zvishandiso zvakagadzirirwa kuongorora kodhi uye zvinoenderana, kwete maitiro emumiriri kana magadzirirwo ayo. BDU Inoona maitiro uye kubatana kwenetiweki, asi kazhinji haina mamiriro ekuchengetedza application kuti itsanangure dependency kana agent configuration. Pakati pezvikamu zviviri izvi zvezvishandiso pane mukaha, chaiwo pari kugadzirwa kodhi izvozvi, uye chaiwo panogara nzvimbo yekurwisa yeAI.
Mukana uyu une nzvimbo nhatu dzisingaonekwe:
- Zvinhu zveAI. Mamodheru, vamiririri, uye maseva eMCP haaonekwe pako SAST's kana SCAradar. Haugone kuverenga zvinhu zvausingakwanise kuona.
- Mafaira ekugadzirisa. Unyanzvi, mitemo, uye MCP configs zvinoumba maitiro emushandisi asi zvinowanzo ongororwa sekunge zviri zvinyorwa zvisina njodzi.
- Kuiswa kwepakeji. A Kuvimba nehutachiona kunogona kutanga kusati kwazivikanwa kuti kune njodzi, wobva waburitsa zvakavanzika nezvipo pasina anobvumirana nazvo.
Maitiro eXygeni ekuivhara
Zvinoitwa neEDR pamagumo, Xygeni Shield inobatsira pakukura kweAI: inodzivirira panogadzirwa kodhi uku ichinzwisisa mamiriro ekuchengetedza application.
- Kuonekwa kupi SAST uye SCA usasvike. Xygeni inoratidza hunyanzvi hwekuita zvakaipa uye inotonga mafaira, inoongorora magadzirirwo eMCP, uye inovaka nzira yekuongorora yakagadzirira. AI-BOM, yakarongwa maererano neOWASP LLM, MCP, uye Agentic Skills Top 10s.
- Ungwaru, kwete masiginecha chete. MEW (Malware Early Warning) inoongorora maitiro nenjodzi yekushandiswa kwepakeji kuti ivharidzire CVE, zano, kana siginecha yeruzhinji isati yavapo. Hungwaru hwemazuva ano hwenetwork hunobvisa kubatana nezvivakwa zvinozivikanwa kuti zvine njodzi.
- Nzvimbo imwe chete yekudzora, kubva pakodhi kusvika pakuguma. Mumiriri mumwe chete, akatumirwa pasina kugadzirisa nharaunda, ane humbowo hwekutonga kwedata reEurope uye kutevedzera mitemo.
Mukuratidzira kwakaitwa pari zvino, mitemo iyi yakavhara kuedza kwemumiriri weAI kuisa package ine njodzi munzira nhatu dzakasiyana dzekuisa (virtual environment, package manager, uye direct download) usati waisa, zvese zvakapinda panguva chaiyo uye zvinotumirwa kuSOC. Kuisa purojekiti yekutanga kunowanzo tora awa imwe chete; kuwedzera kufukidzwa kwesangano rese kunowanzo tora vhiki imwe kusvika mbiri, zvichienderana nechimiro.
FAQ
Chii chinonzi AI attack surface mune imwe ndima?
Nzvimbo yekurwiswa kweAI imhando yemamodeli, vamiririri, maseva eMCP, hunyanzvi, mafaira emitemo, uye zvinoenderana neAI izvo njodzi inogona kupinda muapplication, kazhinji munhu asati aiongorora. Inodarika kodhi yechinyakare uye zvinoenderana neAI kuti isanganise mafaira ekugadzirisa nemirairo inoumba maitiro anoita mumiririri weAI.
Ndingaziva sei kana zita repakeji rataurwa nemubatsiri wangu weAI riri rekufungidzira kana kuti riri rechokwadi asi risingazivikanwe?
Simbisa usati waisa: tarisa registry uye ongorora zviri mukati mepakeji uye chinangwa chayo pane kuvimba nezita chete. Xygeni inozviita otomatiki kuti iyi isimbiswe panguva chaiyo panguva yekugadzira kodhi, saka kuiswa kunotenderwa kana kuvharwa kusati kwatanga, kungave kuti pakeji yacho yaunoziva here kana kuti kwete.
Ko kuslopsquatting kunokanganisa mamodheru ese eAI zvakaenzana here?
Tsvagiridzo iri shure kwenhamba ye19.7% yakafukidza mamodheru akasiyana-siyana uye yakawana kuti nyaya yacho yakapararira zvakanyanya, paine musiyano mudiki pakati pavo. Iyi imhando yekugadzirwa kweAI-assisted, kwete zvikanganiso zvakanangana nemubatsiri mumwe chete.
Tinogona here kuongorora kare kana takatoisa pasuru ine zvinhu zvisinganzwisisike kana kuti ine njodzi?
Ehe. Puratifomu yeXygeni inopa vatengi mukana wekuwana dhatabhesi yemapakeji ane hukasha akaonekwa, anogona kutsvagwa nemidziyo yako iripo, saka unogona kudzvanya kaviri kana paine chinhu chakatoiswa chiri njodzi inozivikanwa.
Kuitwa kwechirongwa ichi kunotora nguva yakareba sei kusangano rine zvikwata zvakawanda?
Kutanga chirongwa chekutanga kunowanzotora awa imwe chete. Kuwedzera sangano rose kunowanzotora vhiki imwe kusvika mbiri, zvichienderana nechimiro chechikwata uye mashandiro azvo.
Mepu yenzvimbo yako yekurwiswa kweAI, mahara
Mepu yeAI yeapp yako mahara: gadzira account uye tanga scan yekutanga mumaminitsiTanga nekushandisa kamwe chete, ona kuti chii chinonzi AI mukati mayo, uye ona kuti ndechipi chikamu chenzvimbo yako yekurwisa AI ine njodzi.
*Mamwe mabasa ataurwa pamusoro apa anosimbiswa kuburikidza neXygeni Shield uye ASPM/AI Security modules; kuwanikwa kunogona kusiyana zvichienderana nehurongwa. Ona xygeni.io kuti uwane ruzivo rwechigadzirwa chiripo.
