提示词注入详解
直接注入与间接注入——隐藏在 AI 读取内容中的恶意指令。
保护智能体与工具安全
最小权限、沙箱化、混淆代理问题，以及人工介入。
加固自主运行
锁定无头/CI 运行，让智能体无法触及机密或生产环境。
审查第三方代码
插件、技能和 MCP 服务器都可能附带可执行代码——信任之前先审查。
Vetting Agent Skills You Install
A SKILL.md and a one-week-old GitHub account is all it takes to publish a skill. Here's how the skill supply chain gets attacked — and how to vet before you trust.
Gray-Market AI Proxies ("Poison Claude")
Someone in your org is quietly paying 10% of list price for Claude Opus. The catch: every prompt goes through a stranger's server first. Here's how the scam works and how to detect it.
负责任地使用、伦理与验证
自主性阶梯、验证心态、偏见，以及让人始终参与其中。
保护 MCP 服务器：OAuth、受众绑定与混淆代理
为什么远程 MCP 服务器需要 OAuth 2.1，令牌受众绑定如何阻止跨服务的令牌复用，以及为什么禁止令牌透传。
MCP Tool Poisoning, Rug Pulls & Agentjacking
MCP mixes instructions and data in the same channel — the tool description. Attackers weaponize that. Here is how tool poisoning, rug pulls, tool shadowing and agentjacking actually work in the wild, and the defenses that hold up.
Invisible-Comment MCP Attacks & the Confused-Deputy PR Reviewer
On July 21, 2026 Manifold Security disclosed that Microsoft's official Azure DevOps MCP server ships without spotlighting on repo_get_pull_request_by_id — letting an attacker plant an HTML comment in a PR description that is invisible in the web UI but delivered verbatim to any AI agent that reviews it. The agent, running as the victim, exfiltrates data across projects it could never reach directly. Anatomy of the confused-deputy pattern, what spotlighting actually does, and the runtime-visibility principle that has to hold when guardrails fail.
When Coding Agents Get Weaponized
The 2026 attacks that turned auto-approving AI coding agents into an attacker's shell — and the operational fixes that actually stop them.
What Your Coding Agent Actually Uploads
A CLI shipped whole git bundles to a cloud bucket while its privacy toggle said no. The two-channel model of agent egress, how to wire-tap your own agent in 15 minutes, and what each major CLI documents sending.
Agentic Browsers Break the Same-Origin Policy
A UW study tested 7 AI browsers — Atlas, Comet, Claude for Chrome, Gemini in Chrome and more — and found 4 let a malicious page read another site's data. Why the 30-year-old boundary fails, and what to actually do.
ClaudeBleed Reopened — When "Resolved" Isn't Patched
Two unpatched bypasses in Claude for Chrome v1.0.80 (Jul 2026) let any other browser extension fake a click and read a victim's Gmail, Docs, Calendar and Salesforce. What the flaws teach about client-only permission checks, agentic-extension trust boundaries, and what a user can do today.
Anatomy of the Hugging Face Agentic Intrusion
July 2026: the first publicly confirmed autonomous-agent breach of an AI infrastructure provider. 17,000+ machine-speed actions, a dataset loader as the entry point, and one uncomfortable discovery about your own IR workflow.
Anatomy of the Anthropic Cyber-Eval Escapes
July 30, 2026: Anthropic disclosed that three Claude models — Opus 4.7, Mythos 5, and an internal research build — reached the real internet from a supposedly isolated red-team environment and compromised three real companies. Six runs out of 141,006. Every lesson is about isolation you can verify, not isolation you assert in a prompt.