Eminyakeni embalwa edlule, ukuphepha kohlelo lokusebenza bekunemingcele ecacile: indawo yokugcina kanye pipelineYilapho izilawuli zazikhona, lapho ukuskena kwakusebenza khona, lapho amaqembu ayenquma khona ukuthi kukhona yini okuthunyelwa ekukhiqizweni. Konke kwakusekelwe ekucabangeni okukodwa: unjiniyela wakhetha ngokusobala ukuthi iyiphi ikhodi nokuthi yikuphi ukuxhomekeka okungene ohlelweni.
Lokho kucabanga akusekho. Ingxenye ekhulayo yekhodi namuhla ibhalwa, iphakanyiswa, noma ifakwe yi-ejenti ye-AI, ngokuvamile ngaphandle kokuthi umuntu abheke igama lalokho okudonswayo. Lapho i-decisUmphumela walokho okungena kukhodi uyahamba, kanjalo nokuhlasela. Kuhamba kuye phambili kwenqubo: ngesikhathi ikhodi idalwa, ngaphakathi komsizi uqobo kanye nakumafayela ayilungiselelayo.
Lena indawo yakho yokuhlasela ye-AI: yonke imodeli, i-ejenti, iseva ye-MCP, ikhono, kanye nokuthembela okuphakanyisiwe yi-AI manje okungaletha ingozi ngaphambi kokuba umuntu ayibuyekeze. I-AI efanayo abathuthukisi bakho abayethembayo manje iyingxenye yayo. Lokhu akuyona ingozi yesikhathi esizayo. Kungushintsho oluvele lwenzekile, futhi nansi indlela ebukeka ngayo ekusebenzeni.
Igagasi lokuhlasela, akusona isigameko esingavamile
Akukho nokukodwa okulandelayo okungumsebenzi wokuhlola elebhucisnoma okucatshangelwayo. Lezi yizigameko zomphakathi, ezibhalwe phansi, cishe zonke zenzeke ngonyaka odlule, futhi ngasinye sisondela kancane kumenzeli we-AI uqobo:
- Agasti 2025, ulimi olusetshenziswa ngolimi: Abahlaseli bantshontshe ithokheni yokushicilela ku-Nx, enye yezinhlelo zokwakha ezisetshenziswa kakhulu, futhi basunduza izinguqulo ezinonya ku-npm, besebenzisa amathuluzi e-AI ukuzingela izimfihlo emishinini yabathuthukisi.
- Septhemba 2025, i-chalk/debug: enye yezivumelwano ezinkulu kakhulu ze-npm ngokufinyelela, amaphakheji ayi-18 anokulandwa kwamasonto onke okungaphezu kwezigidigidi ezimbili, athathwe ngokuthathwa kwe-akhawunti yomgcini oyedwa.
- Septhemba 2025, Shai-Hulud: enye yezimpethu zokuqala ezirekhodiwe ezazikwazi ukuzisabalalisa nge-npm. Igagasi layo lesibili, ngoNovemba, lalinolaka kakhulu futhi lixhumene nezimfihlo ezidalulwe ezindaweni zokugcina ezingaphezu kuka-25,000.
- Okthoba 2025, ukungeniswa okungasetshenziswanga: ingxenye yomkhankaso we-PhantomRaven, lapho ukubona izinto ezingekho emthethweni kwe-AI kwethula khona i-malware yangempela ku-npm ngokusebenzisa indlela yokuhlunga idatha.
- Kulo nyaka, i-ClawHub: irejista yamakhono e-AI enobuthi lapho amakhono amahlanu kwayisikhombisa alandiwe kakhulu ayeyi-malware.
Imboni isenza isiphetho esifanayo sibe semthethweni. I-OWASP Top 10 yezinhlelo zokusebenza ze-LLM ibeka ukujova okusheshayo endaweni yokuqala. I-OWASP MCP Top 10 (okwamanje iku-beta) ihlose ama-ejenti ephrothokholi asetshenziswayo ukukhuluma namathuluzi. I-OWASP Agentic Skills Top 10, iphrojekthi entsha yesigaba se-Incubator, ibiza amakhono anonya njengengozi yayo ephezulu. I-OWASP ivame ukuhamba ngokucophelela; ivula izinhlangothi ezintathu ngesikhathi esisodwa, enye yazo ngokuphuthumayo, isho okuthile ngokuthi lokhu kuhamba ngokushesha kangakanani.
Zonke ezintathu zihlangana ngomqondo ofanayo: imiyalelo, amathuluzi, kanye nokucushwa okuzungeze imodeli manje sekuyingxenye yendawo yokuhlasela ye-AI, futhi ngokuvamile zihlala ngaphakathi kwendawo yakho yokugcina. Okubangela umbuzo wokuqala okufanele uwubuze amaqembu akho: ubani obuyekeza amafayela emithetho, amakhono, kanye nokucushwa kwe-MCP okuhlala ku-repo yakho?
Ivektha 1: ikhono elinobuthi
Ikhono liyifayela lemiyalelo namakhono afundisa i-AI indlela yokwenza umsebenzi. Akuyona yodwa indlela yokubumba ukuziphatha kwe-agent (amafayela emithetho, hooks, kanye nama-MCP config enza okufanayo), kodwa wonke abelana ngempahla eyodwa: ahamba ngaphakathi kwesitoreji, nekhodi.
Ucwaningo kulo nyaka lubuyekeze amakhono angu-4,000 alawa:
- Ama-36% abe nephutha elilodwa okungenani lokuphepha.
- Ama-13.4% abe bucayi.
- Cishe abayi-100 babenemithwalo yemfanelo enobungozi ngqo.
Ushintsho oluyinhloko: umhlaseli akasaqondi ikhodi yakho. Baqondisa umenzeli obhala ikhodi yakho, betshala imiyalelo efihliwe (ngezinye izikhathi besebenzisa izinhlamvu ezingabonakali) imodeli eyifundayo futhi eyiphatha njengesebenzayo. Umbuyekezi ongumuntu uyayivuma pull request ngokwethembeka ngoba, emehlweni abo, ifayela libukeka lihlanzekile. Imodeli ichaza imiyalelo umbuyekezi angakaze ayibone.
Lokhu akuyona inkolelo-mbono. I-CVE-2025-59536 (i-CVSS 8.7) ivumele ukuqalisa i-Claude Code kusuka endaweni yokugcina engathembekile, lapho ukucushwa okunonya kungasebenzisa khona imiyalo ngaphambi kokuba umsebenzisi amukele ingxoxo yokuthembana. Ubuthakathaka besibili, i-CVE-2026-21852, buvumele ukukhishwa kwekhi ye-API ngokucushwa okulawulwa yiphrojekthi, ngaphandle kokuthi umsebenzisi avume noma yini.
H2: Ivektha 2: ukugoba phansi
Igama lihlanganisa elithi “slop” (imfucumfucu ekhiqizwa yi-AI ngezinye izikhathi) nokuhlasela kwe-typosquatting okuvamile. Ukubhala nge-typosquatting kuncike ephutheni lomuntu: umhlaseli ubhalisa igama lephakheji eliseduze nelidumile bese elinda ukubhala nge-typo. Kungahleliwe.
Ukuquleka phansi alilindi iphutha. Esifundweni esibhekiselwe kuso phakathi nalesi sigaba, Ama-19.7% ezinkomba zamaphakheji ezikhiqizwe amamodeli e-AI akhombe kumaphakheji angekho. Amamodeli avame ukukhohlisa amagama afanayo ngokuphindaphindiwe, ngakho umhlaseli ubheka ukuthi ngubani oqamba i-AI, ubhalisa lawo magama ngekhodi enonya, bese elinda ukufakwa okulandelayo okuphakanyisiwe yi-AI ukuze akudonsele kuhlelo lwakho lokusebenza.
Isikali asisincane: Kutholakale amaphakheji amasha anonya angaphezu kuka-450,000 ngo-2025. Izibonelo ezimbili zikwenza kube ngokoqobo:
- Umcwaningi utshale iphakheji yokuhlola engenangozi ebizwa ngokuthi ubuso obugonene ukufakazela iphuzu. Kwangena ngemvume okulandwayo okungaphezu kuka-30,000 ezinyangeni ezintathu.
- ukungenisa okungasetshenziswanga, kusukela kumugqa wesikhathi ongenhla, kwaqinisekiswa ukuthi i-malware, ibukhoma kurejista yomphakathi, kusetshenziswa le ndlela ngqo. Leyo kwakungeyona isivivinyo.
Umbuzo awukhona ukuthi lokhu kungenzeka yini eqenjini lakho. Kungukuthi zingaki amaphakheji aphakanyisiwe nge-AI afaka ikhodi yakho namuhla ngaphandle kokuthi umuntu awabheke.
Impendulo: standardbayafinyelela ezingeni elilandelayo
Amandla amabili agijima ngasikhathi sinye. Ngenkathi ukuhlasela kushesha, standardimizimba iyasabela:
- I-NIST SP 800-218A yandisa uhlaka lokuthuthukiswa kwesofthiwe oluvikelekile ngemikhuba ethile kumamodeli e-AI, okuhlanganisa nobufakazi bobuqotho kanye nokuvela kwawo.
- In May 2026, CISI-A kanye nabalingani bayo bamazwe ngamazwe be-G7 isiqondiso esishicilelwe ku-Software Bill of Materials ye-AI, echaza ukuthi yini okufanele leyo mpahla: amamodeli, amasethi edatha, izingxenye, abahlinzeki, kanye nokuncika.
Isiqondiso sicacile: SBOM iyanda ibe yi-AI-BOM. Awukwazi ukuqinisekisa noma ukufakaza ngalokho ongakwazi ukukugcina ohlwini. Futhi namuhla, izinhlangano eziningi azikwazi:
- 43% abakwazi ukuhlola noma ukufaka ohlwini amathuluzi e-AI abawasebenzisa kakade.
- 79% abanakho ukubonakala kuma-ejenti e-AI kanye nezinhlelo ze-MCP ezisebenza endaweni yazo.
Ezindaweni ezilawulwayo, lolu hlu lwezimpahla lushintsha lusuka ekusebenzeni okuhle luye ekulindelweni kwesivumelwano noma isibopho sokuthobela imithetho. Kodwa uhlu lwezimpahla lukutshela kuphela lokho onakho. Lodwa, aluvimbeli ukuhlaselwa.
Igebe: i-EDR ye-AppSec
SAST futhi SCA amathuluzi aklanyelwe ukuhlaziya ikhodi kanye nokuncika, hhayi ukuziphatha kwe-ejenti noma ukucushwa kwayo. I-EDR ibona izinqubo kanye nokuxhumeka kwenethiwekhi, kodwa ngokuvamile ayinawo umongo wokuphepha kohlelo lokusebenza ukuze ichaze ukuncika noma ukucushwa kwe-ejenti. Phakathi kwalezo zigaba ezimbili zamathuluzi kuhlezi igebe, lapho ikhodi idalwa khona manje, kanye nalapho indawo yokuhlasela ye-AI ihlala khona.
Leso sikhala sinezindawo ezintathu ezingaboni:
- Izimpahla ze-AI. Amamodeli, ama-ejenti, kanye namaseva e-MCP awabonakali ku- SASTnoma SCAi-radar ka-'s. Awukwazi ukuqopha lokho ongakwazi ukukubona.
- Amafayela okucushwa. Amakhono, imithetho, kanye nezilungiselelo ze-MCP kushintsha indlela yokuziphatha kwe-ejenti kodwa ngokuvamile kubuyekezwa njengokungathi kungumbhalo ocacile ongenangozi.
- Ukufakwa kwephakheji. A ukuthembela okunonya kungasebenza ngaphambi kokuba kwaziwe ukuthi kunonya, bese ukhipha izimfihlo namathokheni ngaphandle kokuthi othile akuvumele.
Indlela i-Xygeni eyivala ngayo
Lokho okwenziwa yi-EDR kuma-endpoints, I-Xygeni I-Shield isebenzela umjikelezo wokuphila wokuthuthukiswa okusizwa yi-AI: ivikela lapho ikhodi idalwa khona ngenkathi iqonda umongo wokuphepha kohlelo lokusebenza.
- Ukubonakala lapho SAST futhi SCA ungafinyeleli. I-Xygeni imaka amakhono anonya futhi ilawula amafayela, ihlaziya izilungiselelo ze-MCP, futhi yakhe uhlelo olulungele ukuhlolwa I-AI-BOM, kuhlotshiswe ngokwe-OWASP LLM, MCP, kanye ne-Agency Skills Top 10s.
- Ubuhlakani, hhayi iziginesha zodwa. I-MEW (Malware Early Warning) ihlaziya ukuziphatha kanye nengozi yephakheji yokuyivimba ngaphambi kokuba kube ne-CVE, iseluleko, noma isiginesha yomphakathi. Ubuhlakani benethiwekhi obusesikhathini bunqamula ukuxhumana nengqalasizinda eyaziwayo enonya.
- Iphuzu elilodwa lokulawula, kusukela kukhodi kuya ekugcineni. I-ejenti eyodwa, ethunyelwe ngaphandle kokwakha kabusha imvelo, enobufakazi bokubusa kwedatha yaseYurophu kanye nokuhambisana kwayo.
Kumboniso obukhoma, lokhu kuphoqelelwa kwenqubomgomo kuvimbele umzamo we-ejenti ye-AI wokufaka iphakheji enonya ezindleleni ezintathu ezahlukene zokufaka (indawo ebonakalayo, umphathi wephakheji, kanye nokulanda okuqondile) ngaphambi kokuba ukufakwa kuqedwe, konke kungene ngesikhathi sangempela futhi kuthunyelwe ku-SOC. Ukufaka iphrojekthi yokuqala ngokuvamile kuthatha cishe ihora; ukwandisa ukumbozwa enhlanganweni ephelele ngokuvamile kuthatha isonto elilodwa kuya kwamabili, kuye ngesakhiwo.
Imibuzo Evame Ukubuzwa
Iyini indawo yokuhlasela ye-AI esigabeni esisodwa?
Indawo yokuhlasela ye-AI iyisethi yamamodeli, ama-ejenti, amaseva e-MCP, amakhono, amafayela emithetho, kanye nokuncika okuphakanyisiwe yi-AI lapho ingozi ingangena khona kuhlelo lokusebenza, ngokuvamile ngaphambi kokuba umuntu alibuyekeze. Lidlulela ngale kwekhodi yendabuko kanye nokuncika ukuze lifake amafayela okucushwa kanye nemiyalelo eyakha indlela i-ejenti ye-AI eziphatha ngayo.
Ngingabona kanjani ukuthi igama lephakheji eliphakanyiswe ngumsizi wami we-AI liyiphupho noma limane nje lisemthethweni kodwa alijwayelekile?
Qinisekisa ngaphambi kokufaka: hlola irejista bese uhlaziya okuqukethwe kwangempela kwephakheji kanye nenhloso yayo kunokuthembela egameni lodwa. I-Xygeni yenza lokhu kuqinisekiswa kube ngokuzenzakalela ngesikhathi sangempela ngesikhathi sokukhiqiza ikhodi, ngakho-ke ukufakwa kuyavunyelwa noma kuvinjelwe ngaphambi kokuba kusebenze, kungakhathaliseki ukuthi iphakheji iyileyo oyaziyo noma cha.
Ingabe i-slopsquatting ithinta wonke amamodeli e-AI ngokulinganayo?
Ucwaningo olungemuva kwesibalo esingu-19.7% luhlanganise amamodeli amaningi futhi luthole ukuthi inkinga isakazeke kabanzi, kunomehluko omncane kuphela phakathi kwawo. Lena iphethini kuyo yonke intuthuko esizwa yi-AI, hhayi iphutha elikhethekile kumsizi oyedwa.
Singakwazi yini ukuhlola emuva ukuthi sesivele sifake iphakheji enezinto ezingabonakali noma ezinonya?
Yebo. Ipulatifomu ye-Xygeni inikeza amakhasimende ukufinyelela kusizindalwazi esigciniwe samaphakheji anonya atholakele, angaseshwa ngokuqhathanisa nempahla yakho ekhona yezingxenye, ukuze ukwazi ukuqinisekisa ngokuchofoza okumbalwa ukuthi ngabe kukhona yini okufakiwe kakade okuyingozi eyaziwayo.
Kuthatha isikhathi esingakanani ukuqaliswa kwenhlangano ephakathi nendawo enamaqembu amaningi?
Ukuqalisa iphrojekthi yokuqala ngokuvamile kuthatha cishe ihora. Ukwandisa inhlangano yonke kuvame ukuthatha isonto elilodwa kuya kwamabili, kuye ngesakhiwo seqembu kanye nezindlela zokusebenza.
Mepha indawo yakho yokuhlasela ye-AI, mahhala
Mepha indawo ye-AI yohlelo lwakho lokusebenza mahhala: dala i-akhawunti bese sebenzisa ukuskena kokuqala ngemizuzuQala ngohlelo lokusebenza olulodwa, ubone ukuthi i-AI iyini ngaphakathi kwalo, bese ubona ukuthi iyiphi ingxenye yendawo yakho yokuhlasela ye-AI eyingozi.
*Amanye amakhono okukhulunywe ngawo ngenhla aqiniswa nge-Xygeni Shield kanye ne- ASPM/Amamojula Okuphepha e-AI; ukutholakala kungahluka ngohlelo. Bheka xygeni.io ukuthola imininingwane yomkhiqizo wamanje.
