Kwiminyaka embalwa edlulileyo, ukhuseleko lwesicelo belunemida ecacileyo: indawo yokugcina izinto kunye pipelineKulapho ke kwakuhlala khona ulawulo, apho kwakusebenza khona iskena, apho amaqela ayegqiba khona ukuba kukho into ethunyelwa kwimveliso. Konke kwakuxhomekeke kwingcinga enye: umphuhlisi wakhetha ngokucacileyo ukuba yeyiphi ikhowudi kunye nokuxhomekeka okungene kwinkqubo.
Loo ngcinga ayisekho. Isabelo esikhulayo sekhowudi namhlanje sibhalwa, sicetyiswa, okanye sifakwe yiarhente ye-AI, rhoqo kungekho mntu ujonga igama lento itsalwayo. Xa i-decisi-ion yoko kungena kwikhowudi iyashukuma, kunjalo nohlaselo. Iya phambili kwenkqubo: kwangoko xa ikhowudi idaliwe, ngaphakathi kwi-assistant ngokwayo nakwiifayile eziyilungiselelayo.
Le yindawo yakho yokuhlasela ye-AI: yonke imodeli, iarhente, iseva ye-MCP, isakhono, kunye nokuxhomekeka okucetyiswa yi-AI okunokufaka umngcipheko ngaphambi kokuba umntu ayihlole. I-AI efanayo abayithembileyo abaphuhlisi bakho ngoku iyinxalenye yayo. Le ayisiyongozi yexesha elizayo. Lutshintsho olusele lwenzekile, kwaye nantsi indlela ebonakala ngayo xa kusenziwa.
Uhlaselo olunzima, asilohlaselo lulodwa
Akukho nanye kwezi zilandelayo eyi-lab exercisokanye into ecingelwayo. Ezi ziziganeko zikawonke-wonke, ezibhalwe phantsi, phantse zonke zivela kunyaka ophelileyo, kwaye nganye isondela kancinci kwiarhente ye-AI ngokwayo:
- Agasti 2025, ulwimi olusetyenziswa ngolwimi: Abahlaseli beba ithokheni yokushicilela kwi-Nx, enye yeenkqubo zokwakha ezisetyenziswa kakhulu, baza batyhala iinguqulelo ezinobungozi kwi-npm, besebenzisa izixhobo ze-AI ukuzingela iimfihlo kwiimashini zabaphuhlisi.
- Septemba 2025, itshokhwe/ukulungisa ingxaki: Enye yezona zivumelwano zinkulu ze-npm nge-reach, iipakeji ezili-18 ezinokukhutshelwa ngaphezulu kweebhiliyoni ezimbini ngeveki, ezithathwe ngokubanjwa kweakhawunti yomntu omnye ogcina idatha.
- NgoSeptemba 2025, uShai-Hulud: enye yeempethu zokuqala ezirekhodiweyo ezazikwazi ukuzisasaza nge-npm. Igagasi layo lesibini, ngoNovemba, lalinoburhalarhume ngakumbi kwaye linxulumene neemfihlo ezityhilwe kwiindawo zokugcina ezingaphezu kwama-25,000.
- Okthobha 2025, ukungeniswa kwempahla okungasetyenziswanga: inxalenye yephulo lePhantomRaven, apho i-AI hallucination yazisa i-malware yokwenyani kwi-npm ngokusebenzisa indlela ye-slopsquatting.
- Kulo nyaka, iClawHub: irejista yezakhono ze-AI ezinobuthi apho izakhono ezihlanu kwezisixhenxe ezikhutshelwe kakhulu zaziyi-malware.
Eli shishini lisenza isigqibo esifanayo sibe sesisemthethweni. I-OWASP Top 10 ye-LLM Applications ibeka ukujova ngokukhawuleza kwindawo yokuqala. I-OWASP MCP Top 10 (okwangoku ikwi-beta) ijolise kwiiarhente zeprotocol ezisetyenziswayo ukuthetha nezixhobo. I-OWASP Agentic Skills Top 10, iprojekthi entsha yesigaba se-Incubator, ibiza izakhono ezinobungozi njengomngcipheko wayo ophezulu. I-OWASP idla ngokuhamba ngononophelo; ivula iinxalenye ezintathu ngaxeshanye, enye yazo ngokungxamisekileyo, ithetha into ethile malunga nokuba oku kuhamba ngokukhawuleza kangakanani.
Zonke ezi zintathu zidibana ngengcamango enye: imiyalelo, izixhobo, kunye noqwalaselo olujikeleze imodeli ngoku ziyinxalenye yomphezulu wohlaselo lwe-AI, kwaye zihlala ngaphakathi kwendawo yakho yokugcina idatha. Oku kuphakamisa umbuzo wokuqala ofanele ukubuzwa kumaqela akho: ngubani ohlaziya iifayile zemithetho, izakhono, kunye noqwalaselo lwe-MCP oluhlala kwi-repo yakho?
Ivektha 1: isakhono esinobuthi
Isakhono yifayile yemiyalelo kunye nezakhono ezifundisa iarhente ye-AI indlela yokwenza umsebenzi. Asiyondlela yodwa yokubumba indlela yokuziphatha kwearhente (iifayile zemithetho, hooks, kunye nee-MCP configs zenza okufanayo), kodwa zonke zabelana ngepropathi enye: zihamba ngaphakathi kwindawo yokugcina izinto, kunye nekhowudi.
Uphando kulo nyaka luhlolisise izakhono ezingama-4,000 kwezi:
- Ama-36% ayenesiphako esinye ubuncinane kukhuseleko.
- I-13.4% yayibalulekile.
- Phantse i-100 yayinemithwalo enobungozi ngokupheleleyo.
Utshintsho oluphambili: umhlaseli akasajolisi ikhowudi yakho. Bajolisa kwiarhente ebhala ikhowudi yakho, betyala imiyalelo efihliweyo (ngamanye amaxesha besebenzisa oonobumba abangabonakaliyo) abafundwa yimodeli kwaye bayithatha njengesebenzayo. Umvavanyi ongumntu uyayivuma le pull request ngokunyaniseka kuba, emehlweni abo, ifayile ibonakala icocekile. Le modeli itolika imiyalelo engazange ibonwe ngumvavanyi.
Oku akuyonto ithethwayo. I-CVE-2025-59536 (CVSS 8.7) ivumele ukuqaliswa kwe-Claude Code ukusuka kwindawo yokugcina engathembekanga, apho uqwalaselo olunobungozi lunokusebenzisa imiyalelo ngaphambi kokuba umsebenzisi amkele incoko yokuthembana. Ubuthathaka besibini, i-CVE-2026-21852, buvumele ukukhutshwa kwesitshixo se-API ngokusebenzisa uqwalaselo olulawulwa yiprojekthi, ngaphandle kokuba umsebenzisi avume nantoni na.
H2: Ivektha 2: ukuqubha
Eli gama lidibanisa igama elithi “slop” (inkunkuma eyenziwa yi-AI ngamanye amaxesha) nohlaselo lwe-typosquatting oluqhelekileyo. Ukubhala nge-typosquatting kuxhomekeke kwimpazamo yomntu: umhlaseli ubhalisa igama lephakheji elisondele kwelidumileyo aze alinde ukubhala nge-typo. Kuyinto engacwangciswanga.
Ukuqubha ngesantya esiphezulu ayilindeli mpazamo. Kwisifundo esikhankanyiweyo ngeli xesha leseshoni, I-19.7% yeereferensi zeepakeji ezenziwe ziimodeli ze-AI zikhomba kwiipakeji ezingekhoyo. Iimodeli zidla ngokubona amagama afanayo ngokuphindaphindiweyo, ngoko ke umhlaseli ujonga umntu oqamba amagama e-AI, abhalise loo magama ngekhowudi enobungozi, aze alinde ukufakwa okulandelayo okucetyisiweyo yi-AI ukuze akutsalele kwisicelo sakho.
Isikali asincinci: Iipakethi ezintsha ezingaphezu kwama-450,000 ezinobungozi zachongwa ngo-2025. Imizekelo emibini yenza kube yinto ecacileyo:
- Umphandi utyale iphakheji yovavanyo engenabungozi ebizwa ngokuba ubuso obugonayo ukungqina ingongoma. Yangena ukhuphelo olungaphezulu kwama-30,000 kwiinyanga ezintathu.
- ukungeniswa okungasetyenziswanga, ukusuka kumgca wexesha ongasentla, kwaqinisekiswa ukuba i-malware iyasebenza, ifumaneka kwirejista kawonkewonke, kusetyenziswa kanye le ndlela. Loo nto yayingelulo uvavanyo.
Umbuzo awungowokuba oku kunokwenzeka na kwiqela lakho. Kukuba zingaphi iipakeji ezicetyiswa yi-AI ezifaka ikhowudi yakho namhlanje ngaphandle kokuba umntu azijonge.
Impendulo: standardbayafikelela kwinqanaba elilandelayo
Amandla amabini asebenza ngaxeshanye. Ngelixa uhlaselo lukhawuleza, standardimizimba iyasabela:
- I-NIST SP 800-218A yandisa isakhelo sophuhliso lwesoftware esikhuselekileyo ngeenkqubo ezithile kwiimodeli ze-AI, kubandakanya ubungqina bokuthembeka kunye nemvelaphi.
- In Meyi 2026, CISI-A kunye namaqabane ayo e-G7 aphesheya ipapashe isikhokelo kwiSoftware Bill of Materials ye-AI, ichaza oko kufanele ukuba kukwelo luhlu: iimodeli, iiseti zedatha, izinto, ababoneleli, kunye nokuxhomekeka.
Icala licacile: SBOM iyanda ibe yi-AI-BOM. Awunakuqinisekisa okanye ungqine into ongenakukwazi ukuyigcina kwi-inventory. Namhlanje, uninzi lwemibutho alunakwenza oku kulandelayo:
- 43% abakwazi ukuphicotha okanye ukugcina uluhlu lwezixhobo ze-AI abasele bezisebenzisa.
- 79% azibonakali kwiiarhente ze-AI kunye neenkqubo ze-MCP ezisebenza kwindawo yazo.
Kwiindawo ezilawulwayo, olu luhlu lutshintsha ukusuka kwindlela elungileyo ukuya kwisivumelwano sokulindela okanye isibophelelo sokuthobela imithetho. Kodwa uluhlu lukuxelela kuphela oko unako. Lodwa, aluthinteli uhlaselo.
Isithuba: i-EDR ye-AppSec
SAST kwaye SCA izixhobo zenzelwe ukuhlalutya ikhowudi kunye nokuxhomekeka, kungekhona indlela esebenza ngayo iarhente okanye uqwalaselo lwayo. I-EDR ibona iinkqubo kunye noqhagamshelo lwenethiwekhi, kodwa idla ngokungabi namxholo wokhuseleko lwesicelo ukutolika ukuxhomekeka okanye uqwalaselo lwearhente. Phakathi kwezo ndidi zimbini zezixhobo kukho umsantsa, kanye apho ikhowudi idalwa khona ngoku, kunye nendawo apho umphezulu wohlaselo lwe-AI uhlala khona.
Loo msantsa uneendawo ezintathu ezingabonakaliyo:
- Iimpahla ze-AI. Iimodeli, iiarhente, kunye neeseva ze-MCP azibonakali kwi-akhawunti yakho SASTokanye okanye SCAiradar ka-'s. Awunakukwazi ukuluhlu lwezinto ongenakuzibona.
- Iifayile zoqwalaselo. Izakhono, imithetho, kunye ne-MCP configs zibumba indlela yokuziphatha kwe-agent kodwa zihlala zijongwa ngokungathi azinabungozi.
- Ukufakwa kweepakethe. A ukuxhomekeka kwi-malicious kunokusebenza ngaphambi kokuba kwaziwe ukuba kuyingozi, uze ukhuphe iimfihlo kunye neethokheni ngaphandle kokuba nabani na azivume.
Indlela iXygeni eyivala ngayo
Oko kwenziwa yi-EDR kwiindawo zokugqibela, I-Xygeni I-Shield isebenzela umjikelo wophuhliso oluncediswa yi-AI: ikhusela apho kudalwe khona ikhowudi ngelixa iqonda umxholo wokhuseleko lwesicelo.
- Ukubonakala apho SAST kwaye SCA musa ukufikelela. I-Xygeni ibonisa izakhono ezinobungozi kwaye ilawula iifayile, ihlalutya ulungiselelo lwe-MCP, kwaye yakhe i-audit-ready I-AI-BOM, edweliswe kwi-OWASP LLM, MCP, kunye ne-Agenic Skills Top 10s.
- Ubukrelekrele, kungekhona iimpawu zodwa. I-MEW (i-Malware Early Warning) ihlalutya indlela yokuziphatha kunye nomngcipheko wephakheji yokuyivimba ngaphambi kokuba kubekho i-CVE, ingcebiso, okanye utyikityo loluntu. Ubukrelekrele benethiwekhi yamva nje bunqumla unxibelelwano kwiziseko zophuhliso ezaziwayo ezinobungozi.
- Inqaku elinye lolawulo, ukusuka kwikhowudi ukuya kwisiphelo. Iarhente enye, ethunyelwe ngaphandle kokuphinda iyile okusingqongileyo, enolawulo lwedatha yaseYurophu kunye nobungqina bokuthobela imithetho.
Kwimboniso ebukhoma, olu lawulo lomgaqo-nkqubo luthintele umzamo wearhente ye-AI wokufaka iphakheji enobungozi kwiindlela ezintathu ezahlukeneyo zokufakela (indawo ebonakalayo, umphathi wephakheji, kunye nokukhuphela ngqo) ngaphambi kokuba ukufakela kugqitywe, konke kungene ngexesha langempela kwaye kuthunyelwe kwi-SOC. Ukufaka iprojekthi yokuqala kudla ngokuthatha malunga neyure; ukwandisa ukugubungela kwintlangano epheleleyo kudla ngokuthatha iveki enye ukuya kwezimbini, kuxhomekeke kwisakhiwo.
FAQ
Ithini indawo yokuhlasela ye-AI kwisiqendu esinye?
Umphezulu wohlaselo lwe-AI yiseti yeemodeli, iiarhente, iiseva ze-MCP, izakhono, iifayile zemithetho, kunye nokuxhomekeka okucetyiswa yi-AI apho umngcipheko unokungena khona kwisicelo, rhoqo ngaphambi kokuba umntu asihlole. Idlula ngaphaya kwekhowudi yendabuko kunye nokuxhomekeka ukuze ibandakanye iifayile zoqwalaselo kunye nemiyalelo ebumba indlela iarhente ye-AI eziphatha ngayo.
Ndingayazi njani ukuba igama lephakheji elicetyiswe ngumncedisi wam we-AI liyinto engabonakaliyo okanye lisemthethweni kodwa lingaqhelekanga?
Qinisekisa ngaphambi kokufaka: jonga irejista kwaye uhlalutye umxholo wokwenyani wephakheji kunye nenjongo yayo endaweni yokuthemba igama lodwa. I-Xygeni iyenza ngokuzenzekelayo le mvume ngexesha lokwenziwa kwekhowudi, ngoko ke ukufakwa kuyavunywa okanye kuthintelwe ngaphambi kokuba isebenze, nokuba iphakheji leyo uyayiqonda okanye ayiyazi.
Ngaba i-slopsquatting ichaphazela zonke iimodeli ze-AI ngokulinganayo?
Uphando olungasemva kwenani le-19.7% lugubungele iimodeli ezininzi kwaye lufumanise ukuba ingxaki isasazeke ngokubanzi, kukho umahluko omncinci phakathi kwazo. Le yindlela esetyenziswa kuphuhliso oluncediswa yi-AI, ayilophelo elikhethekileyo kumncedisi omnye.
Ngaba singajonga ngokuphindaphindiweyo ukuba sele sifakile iphakheji enezinto ezingabonakaliyo okanye ezinobungozi?
Ewe. Iqonga leXygeni linika abathengi ukufikelela kwisiseko sedatha esigciniweyo seepakeji ezinobungozi ezifunyenweyo, ezinokukhangelwa kwi-inventri yakho ekhoyo, ukuze uqinisekise ngokucofa kabini ukuba kukho into esele ifakiweyo eyingozi eyaziwayo.
Kuthatha ixesha elingakanani ukuphunyezwa kwesicwangciso kwintlangano ephakathi enamaqela amaninzi?
Ukuqalisa iprojekthi yokuqala kudla ngokuthatha malunga neyure. Ukwandisa umbutho wonke kudla ngokuthatha iveki enye ukuya kwezimbini, kuxhomekeke kulwakhiwo lweqela kunye neendlela zokusebenza.
Imephu yendawo yakho yokuhlasela ye-AI, simahla
Mapha umfanekiso we-AI wesicelo sakho simahla: dala iakhawunti kwaye sebenzisa iskena sokuqala kwimizuzu embalwaQala ngesicelo esinye, ubone ukuba yintoni i-AI ngaphakathi kuyo, kwaye ubone ukuba yeyiphi inxalenye yomphezulu wakho wohlaselo lwe-AI eyingozi.
*Ezinye izakhono ezikhankanyiweyo apha ngasentla zisetyenziswa yiXygeni Shield kunye ASPM/Iimodyuli zoKhuseleko lwe-AI; ukufumaneka kunokwahluka ngokwesicwangciso. Jonga xygeni.io ukuze ufumane iinkcukacha zangoku zemveliso.
