Shadow AI haisisiri vashandi vanoshandisa chatbot isina kutenderwa chete. Nhasi, mumvuri AI kazhinji inosanganisira vamiririri veAI vasina kutenderwa kumhanya nemvumo chaiyo: repo access, CI/CD tokeni, kuverenga/kunyora mafaira, uye maAPI ekutumira mameseji. Nemamwe mashoko, mumvuri weAI unogona kuita se mumvuri otomatiki, uye ndosaka zvichiwedzera njodzi dzekuchengetedza nekukurumidza kupfuura zvinotarisirwa nezvikwata zvakawanda.
Heino mukaha wekuchengetedza: mumvuri weAI unowedzera nzvimbo yako yekurwiswa pasina kuchinja ma controls ako. Semuenzaniso, mumiririri mumwe chete anogona kudya zvemukati zvisingavimbike, kutevedzera mirairo yakavanzwa, uye obva afonera maturusi anobata masisitimu ekugadzira. Nekuda kweizvozvo, njodzi haisi kungobuda kwedata chete; zvakare zviito zvisingatenderwe zvinoitwa nekumhanya kwemuchina.
Kana uchida tsananguro inoshanda unogona kutaura mukati: Shadow AI isimba reAI rinoshandiswa pasina hutongi rinogona kuwana ruzivo rwakakosha kana kukonzera zviito chaizvo. Saka, mhinduro chaiyo haisi yekuti "rambidza AI." Pane kudaro, unoda kuonekwa, mukana wekusakwanisa kuita zvimwe zvinhu, kutonga hunyanzvi, uye kuongorora mashandiro ekushandisa kuti udzore mumvuri weAI pasina kunonoka kuburitswa kwayo.
Chii chinonzi Shadow AI?
Shadow AI kushandiswa kwezvishandiso zveAI, mamodheru, kana ma workflows emumiriri pasina mvumo yepamutemo, yekutarisa, kana yekutonga neIT kana security. Izvi zvinosanganisira machatbots asina kubvumidzwa, browser extensions, maIDE copilots, uye ma local kana hosted agents akabatana ne enterprise maturusi. Chinonyanya kukosha ndechekuti, mumvuri weAI unokonzera matambudziko mukubata data, kudzora mukana wekuwana data, uye kuongororwa kwedata. Saka, zvinogona kushandura mabasa evagadziri vemazuva ese kuita njodzi yekuchengetedza uye kutevedzera mitemo.
Mumvuri AI vs Mumvuri IT vs Mumvuri AI
Shadow AI inopindirana neshadow IT, asi inoita zvakasiyana. Kupfuura zvese, masisitimu eAI anogona dzidza kubva pane zvinopinda uye chiyero checisions, nepo vamiririri vanogonawo ita zviito kuburikidza nezvishandiso nema tokeni. Nekuda kweizvozvo, zvikwata zvinoda muenzaniso wakajeka wezvavari kudzivirira.
| divi | Mvuri IT | Shadow AI | Mumvuri weAgent AI |
|---|---|---|---|
| Chii ichocho | Software kana masevhisi asina kutenderwa | Zvishandiso zveAI zvisina kutenderwa zvinoshandiswa pabasa | Vamiririri veAI vasina kutenderwa vanogona kufonera maturusi uye kuita zviito |
| Muenzaniso wakajairika | SaaS isina mvumo, maplugins, mascripts | Chatbot yega yega kana mupepeti weAI anoshandiswa nedata rekambani | Mumiriri akabatana ne repos, CI/CD, email, matikiti, maAPI egore |
| Dambudziko guru | Kuwanikwa kwedata, kusatevedza mitemo, mukana wekuwana data usina kutarisirwa | Kuburitswa kwedata, kupfuudzwa kwemutemo, kushandiswa kwemuenzaniso usina kuteverwa | Zviito zvisina mvumo, kushandiswa zvisina kunaka kwekodzero, kuburitswa kwemidziyo kunotungamirirwa nemidziyo |
| Kumhanya kwenjodzi | eresera | zvinenge | Inokurumidza zvikuru (otomatiki + zvitupa) |
| Kurwisa nzira | Kushandisa zvisina kunaka kwemagwaro, magadzirirwo asina kuchengetedzeka, kushandiswa zvisina kunaka kweOAuth | Kupinza nekukurumidza, kunyora nekukurumidza kwakanyatsojeka, matambudziko ekuchengetedza data | Kupinza zvishandiso, ketani yekugovera hunyanzvi, kutora kubva kubrowser kuenda kune yemuno, kutenderera kwetokeni |
| Dambudziko rekuonekwa | Mapurogiramu emumvuri nevatengesi vasingazivikanwi | Kushandiswa kweAI kusingazivikanwe + kuyerera kwedata kusingajekeswi | Kushandiswa kweAI kusingazivikanwe + mafoni ezvishandiso zvakavanzika + kutaurwa kusina kujeka |
| Kudzora kwekutanga kwakanakisa | Kuwanikwa kweSaaS + kutonga kwekupinda | Katalogi yeAI yakatenderwa + mitemo yekugadziriswa kwenyaya + kunyora pasi | Inventory yemumiriri + ropafadzo shoma + kunyora mashandisirwo ekushandisa pakushandisa maturusi |
| "Zvakanaka" zvinoita sei | Katalogi yakatenderwa, SSO, kunyora zvinyorwa, ongororo yemutengesi | Katalogi yeAI yakatenderwa, zvidzoreso zvekuchengetedza, kubata data zvakachengeteka | Nguva yekumhanya yemumiriri yakatenderwa, hunyanzvi hwakabvumidzwa, zviratidzo zvakaongororwa, zviito zvakaongororwa |
Nei Njodzi dzeOpenClaw Agent Dzichikosha kuDevSecOps
Mumiriri weOpenClaw ane njodzi huru nekuti vamiririri vanochinja modhi yekuchengetedza kubva pa "data in, text out" kuenda ku data riri mukati, zviito zviri kunze. Mune mumvuri AI mamiriro ezvinhu, zvinoreva kuti mugadziri mumwe chete anogona kumhanyisa mumiririri asina hutungamiriri anobatanidza kune ma repos, CI/CD, maAPI egore, uye maturusi ekutumira mameseji. Nekuda kweizvozvo, mumvuri weAI unoshanduka kuita otomatiki yemumvuri ine zvitupa.
Kuchinja ikoko kunoputsa fungidziro dzinozivikanwa. Semuenzaniso, zvikwata zvinowanzo tarisa "vamiririri vemunharaunda" senjodzi shoma nekuti vanomhanya palaptop kana kuti vanosunga ku localhost. Zvisinei, zviitiko zvechangobva kuitika zveOpenClaw zvinoratidza kuti browser inogona kuva zambuko, ma tokeni anogona kuratidzwa, uye magedhi ezvishandiso anogona kutorwa, kunyangwe muma "local-only" setups.
Muchidimbu, kana mumiririri angokwanisa kufonera maturusi, modhi yako yekutyisidzira inofanira kusanganisira kuba zviratidzo, kushandiswa zvisina kunaka kwezvishandiso, kusawirirana kwehunyanzvi hwekupa zvinhu, uye kupinza zvisina kunangaZvikasadaro, uchapotsa chikamu chine njodzi zvikuru chemumvuri weAI.
Zviitiko zvakanyanya zveOpenClaw (zvakasimbiswa)
1) CVE-2026-25253 — 1-Click takeover / RCE nzira kuburikidza ne link ine njodzi
Impact: Huru (mukana mukuru + kukanganisa kwakanyanya)
Zvayakagonesa (yepamusoro-soro):
- OpenClaw inogona kuwana
gatewayUrlkubva pamutsara wemubvunzo uye wovhura otomatiki kubatana kweWebSocket pasina kubvunza, kutumira kukosha kwechiratidzo mune izvi. - Kuratidzwa kwechiratidzo ichocho kunogona kugonesa kutora suo uye kushandiswa zvisina kunaka kwemuchina zvichienderana nemvumo uye magadzirirwo.
Sei zvakanyanya kudaro:
Zvinoshandura "tinya link" kuita "agent toolchain compromise," ndizvo chaizvo zvinoita kuti mumvuri weAI uve otomatiki yemumvuri ine zvitupa.
2) ClawJacked — webhusaiti inofambiswa nemotokari → localhost WebSocket brute force → full agent hijack
Impact: Yakakwirira kwazvo (yakanyarara + inogona kukwidziridzwa)
Zvayakagonesa (yepamusoro-soro):
Webhusaiti ine njodzi inogona kuvhura kubatana kweWebSocket ku localhost uye kunanga sevhisi yeOpenClaw yemuno.
Nekusimbiswa kwepassword kusina simba, varwisi vanogona kumanikidza password zvakanyanya uye kuwana mukana wekuvimba nawo, zvichibvumira kuguta kwakakwana yemuenzaniso wemumiriri.
Sei zvakanyanya kudaro:
Zvinoputsa fungidziro yekuti "localhost yakachengeteka". Muchokwadi, browser inova zambuko, saka "nzvimbo chete" haisi muganhu chaiwo.
3) Kushandiswa zvisina kunaka kwehunyanzvi hwekuchengetedza nharaunda: ToxicSkills + hunyanzvi hweClawHub hune hutsinye (cheni yekugovera hunyanzvi hwemumiriri)
Impact: Yakakwirira kusvika pakakwirira (chiyero + kuramba uchienderera mberi)
Zvayakagonesa (yepamusoro-soro):
Vane hutsinye kana kuti vasina dziviriro unyanzvi inogona kuita sezvinhu zvinotsamira pamusika: yakaiswa pamusika, yakagadziridzwa yoga, uye inowanzo shanda ne mvumo dzechikamu chemumiriri.
Kuongorora tsvakurudzo yakazvimirira 3,984 hunyanzvi hwemumiriri hwawanikwa 13.4% (534) yaive nedambudziko rimwe chete rakakosha, kusanganisira kuparadzirwa kwemalware, kuiswa nekukurumidza, uye zvakavanzika zvakafumurwa.
Mienzaniso yenyika chaiyo ratidza varwisi vanotumira "hunyanzvi" hwe crypto-themed kuti vasundire malware kana kuba data rakavanzika kuburikidza ne social engineering uye mirairo isina kujeka.
Sei zvakanyanya kudaro:
Iyi injodzi yekutengeserana kwezvinhu, asi kune vamiririri: "hunyanzvi" hunogona kugara nhaka kugona kwemumiririri kuverenga mafaira, kuwana zvakavanzika, kana kuita zviito zvezvishandiso.
| Zviitiko | Attack type | Kubatana kwevashandisi | Mugumisiro wekutanga | Sources |
|---|---|---|---|---|
| CVE-2026-25253 | Chinongedzo chakaipa → query-string gatewayUrl → kuratidzwa kwechiratidzo → kutora kwegedhi / nzira yeRCE | Kudzvanya kamwe chete (UI:R) | Kubvumirana kwegedhi; mhedzisiro inogona kuitika pasi zvichienderana nemvumo | NVD (NIST) INCIBE-CERT The Hacker News |
| ClawJacked | Nzvimbo yekutyaira → localhost WebSocket → brute force → agent hijack | Shanyira webhusaiti | Kutora kwevamiriri vemunharaunda zvizere; log/config/data access | Kuchengetedzwa kweOasis TechRadar The Hacker News |
| Unyanzvi hweToxicSkills / hunyanzvi hweClawHub hune hutsinye | Musika wehunyanzvi senzira yekugovera zvinhu (malware, jekiseni, kufumurwa muzvinhu zvakavanzika) | Zvinoshanduka (unyanzvi hwekuisa/kushandisa) | Kusawirirana kwemumiriri kuburikidza nemvumo dzakagarwa nhaka uye hunhu hwehunyanzvi hwakaipa | Tom's Hardware The Hacker News |
Muenzaniso wekushandisa: kuderedza njodzi yeOpenClaw-style Shadow AI nekushanda kweDevSecOps
OpenClaw chidzidzo chinobatsira nekuti chinoratidza kuti sei mumvuri AI inova njodzi chaiyo yekushanda: mumiririri anomhanya "munharaunda," anobatanidza kune ma repos uye pipelines, uye kamwe kamwe kushanya kwebrowser, token, kana hunyanzvi hwechitatu hunogona kushanduka kuita kutora. Chinangwa hachisi chekurambidza vamiririri. Pane kudaro, ndechekuona kuti basa rinotungamirwa nevamiririri rinofamba kuburikidza nekutonga kumwe chete kwaunovimba nako kare kwekodhi neketani yekugovera.
Danho 1: Bata "hunyanzvi" hwemumiririri sekushandisa zvinhu zvinoenderana nezvinodiwa nevamwe, kwete sezvinhu zvisingakuvadzi
Zviitiko zvizhinji zve shadow AI hazvitangi nekushandisa kwakaomarara. Zvinotanga nekutora: mugadziri anoisa mumiririri, anowedzera hunyanzvi hushoma, uye anomupa mukana wekuti "zvishande." Kubva panguva iyoyo, agent ecosystem inoita se package ecosystem: skills update, helper scripts dzinoonekwa, uye untrusted code inogona kupinda chinyararire.
Saka danho rekutanga nderekuchinja mafungiro: Chero chipi zvacho chinogona kuiswa kana kuitwa nemumiririri chikamu cheketani yako yekutengesa. Mune Kufambiswa kwebasa kweXygeni, zvinoreva kuti haumiriri mushumo wekutyora mutemo. Unotarisa pane zviratidzo zvekare zvekuti chikamu chine njodzi kana kuti chine njodzi huru, saka kushandiswa kwacho kunomira kusati kwapararira muma repos nema developer machines.
Ndezvipi zvakachinja mukuita
- Matimu anomira kukopa-kunama "working agent configs" pasina kuongororwa
- Unyanzvi hutsva nemapakeji ekubatsira anobatwa sekushandisa vanhu vanovimba newe, kwete kushandisa maturusi emunhu wega
Danho rechipiri: Ita kuti maPR ave nzvimbo yekutonga, kunyangwe kana mumiririri akanyora shanduko
Vamiririri vanokurumidza kuchinja. Ndiyo pfungwa yacho. Zvisinei, nyaya yeOpenClaw inoratidza kuti "shanduko diki" dzinokurumidza sei kuva zviitiko zvekuchengetedza kana zviratidzo nemagedhi ezvishandiso zvabatanidzwa. Saka, kuvimba ne "chenjedzo yevagadziri" hakuna kukwana.
Pane kudaro, mumiririri wenzira anoburitsa kuburikidza pull requests uye simbisa kuskena panguva yePR. Nenzira iyoyo, kunyangwe kana mumiriri akakurudzira dependency bump, build script tweak, kana CI workflow edit, PR inova nzvimbo inonetsa apo mutemo unoshandiswa. Xygeni inokodzera pano nekuti ndiyo yakavakirwa CI/CD uye PR workflows, saka shanduko dzine njodzi dzinoonekwa dzisati dzabatana.
Shanduko dzakajairika dzinotungamirirwa nevamiririri dzaunoda kuti dzivharwe
- Kuvandudzwa kwekuvimbika uye kukiya mafaira
- Gadzira zvinyorwa uye isa hooks
- Kugadziriswa kwekushanda kweCI (mvumo, kushandiswa kwezvakavanzika, mafoni enetwork)
- Matanho matsva e otomatiki anomhanya nekodzero dzakakwidziridzwa
Danho rechitatu: Isa zvinhu zvichashandiswa nevapambi pakutanga, kwete chete zvinowanikwa nemaskena
Shadow AI inowedzera vhoriyamu. Kuwedzera otomatiki zvinoreva kuwedzera kwekushandiswa kwevashandi, kuchinjika kwemagadzirirwo, uye "kuchinja kudiki" pasvondo. Nekuda kweizvozvo, zvikwata zvinogona kunyura mune zvakawanikwa kunze kwekunge zvinhu zvakakosha zvichionekwa sekushandisa kwakakodzera.
Apa ndipo panonyanya kukosha nyaya yekushandisa. Kana imwe nyaya ingangoshandiswa asi imwe isingashandiswi, mafambiro ebasa rako anofanira kuratidza musiyano iwoyo. Xygeni's nzira yekuisa zvinhu pakutanga yakagadzirirwa chokwadi ichi: kuderedza ruzha nekutarisa kugadzirisa zvinhu zvinonyanya kukosha.
Mutemo uri nyore unoyera
- Kugadzirisa matambudziko ane njodzi huru kana kuti nekukurumidza
- Regedza ruzha rusina ruzha rwakanyanya kuitira kuti mainjiniya arambe achitumira zvinhu zvakachengeteka
Danho rechina: Rega kufunga kuti "localhost yakachengeteka"
ClawJacked inoshanda sechidzidzo nekuti inorwisa fungidziro yatichiri nayo muzvikwata zvakawanda: "kana iri yemuno, hazvina dambudziko." Muchokwadi, magedhi emuno nemaUI emuno achiri kuda kufunga nezvekugadzirwa. Browser chikamu chenzvimbo yekutyisidzira, uye "yemuno chete" haisi muganhu waunogona kuvimba nawo.
Saka unoomesa masevhisi emuno sezvaungaita chero interface inonzwisisika:
- Kusimbiswa kwakasimba (kwete password yakasarudzwa nemunhu chete)
- Miganhu yemitengo uye kuvharirwa kunze
- Hapana maitiro ekubatanidza otomatiki anovimba nezvinongedzo zvisina kushanda
- Chengetedza kuti ndiani anogona kubatana uye kubva kupi
Kunyange zvazvo Xygeni isiri localhost firewall, inobatsira kuderedza kushanda kwemaitiro e "local bypass" nekufambisa mutemo ku pipeline uye puratifomu. Kana vanodzora vari mukati CI/CD uye mitemo yekuchengetedza mamiriro ekuchengetedza, mumvuri weAI hauwanzovapfuura "nekuti waive wemunharaunda."
Danho rechishanu: Chenjerera maitiro asina kujairika anoita sekunge kushandiswa zvisina kunaka kwecheni yekutenga zvinhu
Zviitiko zveOpenClaw zvinowanzo fanana nenzira yekukundikana: chimwe chinhu chinochinja chinyararire, uye mashandiro ebasa anotanga kuita zvakasiyana. Ndosaka zviratidzo zvinotarisa pane zvisina kujairika zvichikosha. Kana nharaunda ikangoerekana yatanga kukwezva zvinhu zvisingawanzoitiki, kuburitsa mavhezheni nekukurumidza, kana kuratidza maitiro anoenderana nekushungurudzwa kwecheni yekushandisa, unoda kuti izvozvo zviratidzwe nekukurumidza.
Kuonekwa kweXygeni's anomaly uye kurongwa kwekunyevera kwekutanga kunoenderana nechinangwa ichocho: kuratidza maitiro anofungidzirwa pakutanga, asati ava zviitiko zvinodzokororwa mumapoka.
Zviratidzo zvakakodzera kunyeverwa pa
- Kuchinja kamwe kamwe kwekuvimbana pakati pemakambani anotengesa zvinhu
- Mapakeji/hunyanzvi hutsva husina mukurumbira wakanaka kana maitiro ekuvandudza asinganzwisisike
- Matanho eCI asingatarisirwi anodhawunirodha nguva dzekushanda kana kuita zvinyorwa
- Kufona kwenetiweki kusingawanzoitiki kubva kumamiriro ekuvaka
The takeaway
Mafambiro aya haasi e "agent-specific." Ipatani yeDevSecOps inoshanda kune mumvuri weAI padanho guru: tarisa hunyanzvi hwakadai sekutsamira, shanduko dzegedhi panguva yePR/CI, isa zvinhu zvinogoneka pakutanga, rega kuvimba nelocalhost nedefault, uye ona maitiro asina kujairika e supply chain nekukurumidza. Ndiyo nzira yaunodzikisa nayo. mumvuri AI njodzi pasina kunonoka kuendesa.
Kuchengetedzwa kweShadow AI: Izvi Zvinorevei kuMatimu eDevSecOps
Shadow AI haisisiri dambudziko repadivi. Muna 2026, zvinoreva kuti iri kuramba ichishandiswa. vamiririri vane mvumo chaiyo, izvo zvinoshandura zvikanganiso zviri nyore kuita zviitiko zvinotungamirirwa nezvishandiso. OpenClaw ndiyo chiyeuchidzo chakajeka: njodzi haisi izvo "zvinotaurwa" nemodhi chete, asi izvo mumiririri anogona kuita. do nezviratidzo, masuo, uye hunyanzvi.
Saka, mhinduro inoshanda zvikuru ndeyekushanda, kwete yekufungidzira. Bata hunyanzvi hwemumiririri hwakadai sekutsamira pamunhu, kuendesa mhedzisiro yemumiririri kuburikidza nePR uye CI/CD guardrails, uye rega kufunga kuti "localhost yakachengeteka." Panguva imwe chete, tanga nekutanga zvinhu zvinogona kushandiswa kuitira kuti mapoka arambe achitumira zvinhu pasina ruzha.
Pakupedzisira, haufanirwe kurambidza vamiririri kuti vatonge kuchengetedzwa kwemumvuri weAIUnofanira kuva nechokwadi chekuti mashandiro ebasa anotungamirwa nevamiririri haagone kudarika nzira imwechete yekugovera uye nzira dzekutumira dzinotochengetedza hupenyu hwesoftware yako.
