Amjad Masad 发布了一份安全建议，认为运行在员工终端上的 AI Agent 正成为企业和政府的系统性安全风险。一些机构已经开始限制 Claude Code 等工具；原文提到，据报道高盛采取了这样的措施。Replit 提出的办法，是让 Agent 默认运行在专用、受组织控制的云环境中，只访问完成当前任务所需的资源。

建议书认为，供应链攻击原本就能侵入开发者电脑，并调用已安装的 AI 工具搜索企业敏感信息。Agent harness 往往拥有广泛权限，而人工监督正在减少，使其越来越值得攻击者关注。无人值守的自动化同样可能被 GitHub Issue 或邮件中隐藏的指令引向私有数据和未授权操作。

个人 Agent 会进一步放大这类风险：它们主要由个人控制，组织管理不足，防护措施不一致，又被鼓励主动行动。读取每封邮件和日历邀请，也意味着每次互动都可能接触提示注入。Replit 因此主张，继续采用 Agent 的同时，要为会读取不可信内容、运行代码、代表用户行动的软件提供专门的执行环境；凭证、权限、网络访问和生产变更的控制应放在 Agent 无法自行改变的位置。

使用增长快于治理

原文引用 Stack Overflow 调查：使用或计划使用 AI 工具的受访者比例，从 2023 年的 70% 升至 2024 年的 76%，再到 2025 年的 84% [1][2]。这些数据反映的是不同年度样本中 AI 工具的采用与使用意向，并不是自主 Agent 使用率。

Salt Labs 在其客户环境中检测到 MCP 相关基础设施的比例，从 2026 年 1 月的 16.7% 升至 8 月的 21.6%，增加 4.9 个百分点 [3]。原文提醒，这只是该供应商客户环境的观察，能否代表整个行业、前后客户样本是否一致，都还没有确定。

部署与控制之间的差距更值得注意。在 Salt Security 2026 年 10 月的调查中，86.4% 的受访者说组织内至少有一个 Agent 在运行，但只有 17.5% 能自动停止在生产中出现异常行为的 Agent，只有 12.5% 能持续追踪所有 Agent 的完整执行路径 [3]。

另一项 Cloud Security Alliance 研究中，47% 的受访者称过去一年发生过 Agent 相关安全事件，54% 称组织内有 1 到 100 个未经批准的 Agent，只有 31% 称组织正式采用了 Agent 治理政策 [4]。这项研究在 2025 年 9 月和 11 月调查了 445 名 IT 与安全专业人员，于 2026 年 4 月发布；Zenity 提供经费并参与设计问卷。原文认为，它支持治理存在缺口的判断，但不能把它与 Salt 的结果拼成一条事件率趋势。

不同攻击中的边界失效

建议书逐项列出了事故和研究案例，分别说明证据范围。

个人 Agent 接入敏感系统。 WIRED 报道，一名 Accenture 承包商将个人 Claude Code 账号接入美国国防部的敏感环境，凭证和系统信息似乎流向了第三方服务 [5]。Accenture 否认这些指控，称独立调查认为指控没有根据。WIRED 也表示，没有迹象说明攻击者访问了机密或绝密系统。原文用这一争议案例说明敏感基础设施与个人 Agent 工具之间出现失控连接的风险，而非将争议当成定论。

开发者电脑上的恶意扩展。 WIRED 报道，经 Cursor 市场分发的一个被篡改的 Claude Code 扩展，最多被 5000 名用户下载；它不是 Anthropic 发布的版本 [6]。Cursor 介绍，该扩展收集主机信息，并尝试安装持久化 SSH 后门 [7]。实现错误限制了后门在大部分受影响 macOS 和 Windows 主机上的效果，但仅卸载扩展不一定能移除持久化机制。原文提醒，不能依赖攻击者下次仍犯同样的错误。

恶意软件包调用 AI 工具寻找密钥。 在 2025 年 8 月 Nx 的 s1ngularity 攻击中，恶意软件包利用电脑上已有的 Claude、Gemini 和 Q 命令行工具辅助侦察。Wiz 观察到数百起成功的 AI 辅助活动，以及超过 1000 个有效 GitHub token 泄露。后续攻击使用这些 token，将超过 5500 个私有仓库公开，影响了 400 多名用户或组织；开发者电脑和部分构建流水线都受到了影响 [8]。

合法工具也可能成为数据外传通道。 Invariant 演示了如何通过一个恶意公开 GitHub Issue，诱导使用 GitHub MCP 的 Agent 读取私有仓库资料，再将其写入公开 PR [9]。演示中的 MCP 服务器本身没有被攻破。这证明了一条可能的攻击路径，原始来源并未报告大规模泄露；获准使用的工具和目的服务，仍可能承载未经授权的数据转移。

工具跑出了预期沙箱。 CodeRabbit 确认，研究人员于 2025 年 1 月发现 RuboCop 在沙箱外运行 [10]。公司称，它在 12 小时内完成了全面修复，没有发现客户数据被访问或存在恶意活动的证据。原文据此强调，隔离范围必须覆盖每一个可执行工具和子进程，不能只覆盖主要 Agent 运行时。

云端 Agent 暴露关联账号凭证。 Salt Labs 演示了如何用恶意邮件内容，诱导 Manus 在云沙箱中执行代码；关联服务的 token 当时可被读取，安全警告却在载荷执行后才出现 [11]。Salt 称漏洞后来已修复。这也是云托管本身不等于安全的一个反例。

合法签名权限被滥用。 Elliptic 对 10 月 29 日 Binance 失窃事件的分析认为，攻击者可能诱使 Binance 自身系统签署未经授权的交易。Binance 最初提到 DevOps 笔记本可能失陷，后来又披露其他入侵点，完整路径仍未确定。在以太坊上，签署的 EIP-7702 授权将热钱包的行为委托给攻击者控制的合约，而且委托在最初那笔交易后仍然有效 [12]。原文明确说明，这不是 AI Agent 攻击的证据；它体现的是另一项控制要求：即便凭证没有被直接窃取，只要失陷的调用方能用它授权有害操作，保护凭证本身也不够。

原文将这些案例中的共同问题归为三类：不可信软件带着过大权限执行、不可信内容被当作指令，以及控制措施未能阻止最终操作。

为什么主张受管云环境

员工工作站可能同时拥有浏览器会话、SSH key、云凭证、私有仓库、内网访问和其他业务数据，远多于多数 Agent 任务所需的权限。

专用云环境可以把 Agent 执行与工作站分离。组织能够只配置必要工作区，集中实施访问控制，独立记录操作，并在需要时停止或重建环境，而不必重建员工电脑。要获得这些收益，执行、策略实施和可观测性都必须真正进入受控环境。

本地扩展即使把提示词发给云端模型，仍可能在本机执行代码。同样，把生产凭证复制到远端、给远端 Agent 不受限的网络访问，只是把风险挪了地方。目标是将失陷的 Agent 或依赖限制在一个权限有限的工作区内，组织政策对它的约束不应取决于员工本人拥有多大的权限。

原文图 2 的文字说明描绘了这种边界：Agent 与工具运行在组织控制、任务限定的专用沙箱内，与员工设备的广泛权限分离；独立系统代理凭证，约束权限及流向获准资源的数据。审计、审批和遏制措施必须在 Agent 控制之外执行，而且这些保护需要经过验证，不能仅靠云托管的名称。

需要独立实施的控制

建议书要求将 Agent 执行视作不可信，并列出以下控制项：

• 经过验证的执行隔离。 Agent、安装脚本、工具和依赖都应运行在专用沙箱内，安全实施机制放在其控制之外；不继承员工主目录、浏览器会话或不受限的企业网络权限。
• 经纪式凭证与独立身份。 外部服务凭证不应出现在 Agent 可读的内存、文件或环境变量中。请求通过代理授权，并绑定 Agent、发起人、组织和具体任务。
• 逐步提权授权。 隔离凭证还不够，操作、目标资源、目的地和委托权限的变化，都需要独立检查。高影响操作必须明确批准；拥有合法身份或能访问签名服务，不等于已经获准执行某项操作。
• 任务范围内的权限。 每次运行只获得需要的资源和操作权限，Agent 不得提升自身权限，也不得修改约束自己的政策。
• 网络与数据流限制。 对 DNS、直接 IP 访问、云元数据访问和外部请求加以控制；即使在同一个获准服务内部，也要区分操作和数据目的地。允许访问 GitHub，不等于允许把私有数据发布到 GitHub 任意位置。
• 独立的生产边界。 Agent 可以提出改动，但不应长期持有生产写入权限。重要变更由可信的审批与部署系统实施，并向审批者展示真正将被授权的操作。
• 受控的软件供应链。 核查来源、固定获准版本、审阅工具和 MCP 配置的变化；安装依赖时不带生产凭证。
• 独立审计与遏制。 在 Agent 无法修改的位置记录操作及实施决策，不依赖 Agent 配合就能自动遏制或撤销权限。遏制还必须撤销已授予下游的委托与权限，而不只是停止最初进程或轮换凭证。

组织可以先做什么

Replit 建议，把获准的受管云 Agent 环境作为自主开发的标准路径；盘点现有本地 Agent 和扩展，移除不必要的访问，并禁止个人 Agent 账号连接敏感生产系统。

供应商应实际证明这些边界：Agent 读不到服务凭证，不能绕过网络控制、扩大权限、修改审计记录或未经批准改动生产。遏制能力也应经过实测，包括紧急停止开关是否真的能停止 Agent 活动。

可能受影响的 Cursor 安装，应先按供应商事件响应指南处理。把未来工作移到云端，并不能修复一台已经失陷的终端 [7]。监管行业和政府业务则应只使用获准处理相关数据与系统的环境，并检查模型端点、日志、存储和外部工具是否满足数据驻留、保留、合同及认证要求。

建议书最后说明，它推荐的是有可验证安全控制支撑的云执行。所引资料并未建立本地 Agent 与云 Agent 之间可比的泄露率；它们说明的是隔离、有限权限、凭证分离和独立实施为何重要。每个 Agent 的访问都应按具体任务划定。

原文另推荐 Replit 提出的 Agent Habitat Architecture 及其基于证据的成熟度分级，作为评估独立权限、经纪式凭证、受控数据流和带外遏制的参考框架。每一款云 Agent 产品仍需单独核查实际实现了哪些控制。

原文参考资料

以下资料由原文列出，查阅日期均为 2026 年 11 月 1 日；本站未在本轮重新核验这些外部材料。

1. Stack Overflow：AI | 2024 Developer Survey。
2. Stack Overflow：AI | 2025 Developer Survey。
3. Salt Security：Nearly half of enterprises report an AI agent took an unauthorized action last year，2026 年 10 月 13 日。
4. Cloud Security Alliance：More than half of organizations experience AI agent scope violations，2026 年 4 月 16 日。
5. V. Elliott：A defense contractor gave their personal AI agent access to a secure Pentagon system | WIRED。
6. L. H. Newman：A supply chain attack put malicious Anthropic Claude extensions on thousands of devices | WIRED。
7. Cursor：Claude Code extension security notice，2026 年 10 月 30 日更新。
8. M. Bar、R. McCarthy：s1ngularity: Supply chain attack leaks secrets on GitHub | Wiz，2025 年 8 月 27 日发布、8 月 29 日更新。
9. Invariant Labs：GitHub MCP vulnerability research。
10. H. Gill：Our response to the January 2025 Kudelski Security vulnerability disclosure | CodeRabbit，2025 年 8 月 19 日。
11. Salt Labs：How we hijacked an AI agent with a single email，2026 年 10 月 1 日。
12. T. Robinson：The largest theft in history: North Korea behind the $6.4 billion Binance hack | Elliptic，2026 年 10 月 30 日发布、11 月 1 日更新。

AI agents running on employee endpoints are becoming a systemic security risk for enterprises & governments.

Some are responding by restricting tools like Claude Code, as Goldman Sachs reportedly has.

In this security advisory, we outline the risks and recommend a path forward.

---

Security advisory: Make managed cloud environments the default for AI agents

AI agents should operate in dedicated, organization-controlled environments with limited access to the resources each task requires. Recent security incidents [5], [6] and research demonstrate why this is a growing necessity. Supply-chain attacks have always been able to compromise developer machines and recruit installed AI tools to search for sensitive corporate information and data. Agent harnesses are typically given broad privileges and have a shrinking amount of human oversight. Combined, these two effects are making agents an increasingly interesting target for attackers. Even unattended automations are being targeted: instructions hidden in a GitHub issue or email can redirect an agent toward private data and unauthorized actions. The rise of personal agents increases the risk even more, since they are insufficiently managed by organizations, mostly controlled by individuals, run with an inconsistent set of guardrails, and are incentivized to be proactive above all else: they read every email, every calendar invite; Every interaction is an opportunity to get prompt-injected. There is a better way forward: Organizations can continue adopting agents by giving them execution environments designed for software that reads untrusted content, runs code, and acts on a user’s behalf. In a world where agents are becoming more prevalent, @Replit believes that organizations must make managed, isolated cloud agents the default for autonomous development, with credentials, permissions, network access, and production changes controlled outside the agent’s reach. Adoption is growing faster than control AI development tools are becoming standard. Stack Overflow reports that the share of respondents using or planning to use AI tools rose from 70% in 2023 to 76% in 2024 [1] and 84% in 2025 [2]. This establishes the scale of AI-tool adoption and intent across annual respondent samples. Autonomous-agent usage falls outside the specific scope of this measure. Agent infrastructure is also expanding. Salt Labs [3] detected MCP-related infrastructure in 16.7% of its customer environments in January 2026 and 21.6% in August: a 4.9-percentage-point increase. These observations are limited to the vendor’s customer environments. Their applicability to the wider industry and the consistency of the customer cohort remain unestablished. The more consequential finding is the gap between deployment and control. In Salt Security’s October 2026 survey [3], 86.4% of respondents reported at least one agent operating in their organization, but only 17.5% could automatically stop an agent behaving unexpectedly in production. Only 12.5% could consistently trace complete agent paths across all agents.

A separate Cloud Security Alliance study reinforces the concern [4]: 47% of respondents reported an agent-related security incident in the preceding year, 54% reported between one and 100 unsanctioned agents, and only 31% reported formally adopted agent-governance policies. The study surveyed 445 IT and security professionals in September and November 2025 and was published in April 2026. Zenity financed the research and co-developed the questionnaire. These findings corroborate a governance problem; they should not be combined with Salt’s results into a single incident-rate trend. Different attacks, recurring boundary failures The evidence extends beyond any one model, vendor, or delivery mechanism. Sensitive-system access through a personal agent. WIRED reports that an Accenture contractor connected a personal Claude Code account to a sensitive Department of Defense environment and that credentials and system information appear to have reached a third-party service [5]. Accenture disputes the allegations, saying an independent investigation found them without merit. WIRED reports no indication that attackers accessed classified or top-secret systems. The risk illustrated is an uncontrolled connection between sensitive infrastructure and personal agent tooling. A malicious extension on developer machines. WIRED reports that a tampered Claude Code extension distributed through Cursor’s marketplace was downloaded by at most 5,000 users [6]. It was not an Anthropic-published release. Cursor describes host-information collection and attempts to install a persistent SSH backdoor [7]. Implementation errors limited the backdoor’s effectiveness on most affected macOS and Windows hosts, but uninstalling the extension alone may not remove its persistence mechanisms. We cannot rely on attacker mistakes in the future. Compromised packages recruiting AI tools to find secrets. In the August 2025 Nx “s1ngularity” campaign, malicious packages used previously-installed Claude, Gemini, and Q command-line tools to assist reconnaissance. Wiz [8] observed successful AI-assisted activity in hundreds of cases and more than 1,000 valid GitHub tokens exposed. A subsequent phase used leaked tokens to make over 5,500 private repositories public, affecting more than 400 users or organizations. Developer machines and some build pipelines were affected. Private data leaked through legitimate tools. Invariant [9] demonstrated that a malicious public GitHub issue could persuade an agent using GitHub MCP to retrieve private-repository information and publish it in a public pull request. The researchers demonstrated this attack using an uncompromised MCP server. The demonstration establishes a possible attack path; the source reports no mass breach. An approved tool and destination can still carry an unauthorized data transfer. A tool running outside its intended sandbox. CodeRabbit confirmed that researchers discovered RuboCop operating outside its sandbox in January 2025 [10]. The company says it deployed a comprehensive fix within 12 hours and found no evidence of customer-data access or malicious activity. The lesson is that isolation must extend from the primary agent runtime to every executable tool and subprocess. A cloud agent exposing connected-account credentials. Salt Labs demonstrated that malicious email content could induce code execution in Manus’s cloud sandbox, where connected-service tokens were accessible [11]. A security warning appeared after the payload was executed. Salt says the flaw has since been resolved. This research is an important counterexample to the idea that cloud hosting alone provides security. Compromised infrastructure misusing legitimate signing authority. Elliptic’s analysis of the October 29 Binance theft suggests attackers induced Binance’s own systems to sign unauthorized transactions. Binance initially reported a possible compromised DevOps laptop and later disclosed additional breach points; the full intrusion path remains unresolved. On Ethereum, signed EIP-7702 authorizations delegated a hot wallet’s behavior to an attacker-controlled contract, with delegation persisting beyond the initial transaction [12]. This is not evidence of an AI-agent attack. It illustrates a relevant control requirement: protecting credentials is insufficient if a compromised caller can use them to authorize harmful actions. Together, these cases illustrate three recurring problems: untrusted software executing with excessive access, untrusted content being treated as instructions, and controls that do not prevent the resulting action. Why managed cloud agents are the better default An employee workstation may contain browser sessions, SSH keys, cloud credentials, private repositories, internal-network access, and unrelated business data. That is far more access than most agent tasks require. A dedicated cloud environment makes it possible to separate agent execution from that workstation. The organization can provision only the necessary workspace, enforce access centrally, record actions independently, and stop or rebuild the environment without rebuilding the employee’s laptop. Realizing that benefit requires moving execution, policy enforcement, and observability into the controlled environment. A local extension that sends prompts to a cloud model still executes local code. Likewise, a remote agent with copied production credentials and unrestricted network access reproduces the same risks elsewhere. The objective is to contain a compromised agent or dependency within a limited workspace. Organizational policy must govern the agent’s access independently of the employee’s broader authority. 📷 Fig. 2. A conceptual security boundary for autonomous agents. The agent and its tools run in a dedicated, task-scoped sandbox within an organization-controlled environment, separate from the employee device’s broader authority. Independent controls broker credentials and govern permissions and data flows to approved resources. Audit records, approval gates, and containment are enforced outside the agent’s control. Cloud hosting requires verified controls to provide these protections. Required controls It is recommended to treat agent execution as untrusted and enforce boundaries independently of the agent’s cooperation. Organizations should require: Verified execution isolation. Keep agents, installation scripts, tools, and dependencies inside dedicated sandboxes. Place security enforcement outside their control. Do not inherit employee home directories, browser sessions, or unrestricted corporate-network access. Brokered credentials and distinct identities. Keep external-service credentials out of agent-readable memory, files, and environment variables. Authorize requests through a broker, bound to the agent, initiating principal, organization, and task. Step-up Authorization: Credential isolation must be paired with independent checks on the requested operation, target resource, destination, and any change in delegated authority. Require explicit approval for high-impact actions; possession of a valid identity or access to a signing service is not sufficient authorization. Task-scoped permissions. Give each run only the resources and operations it needs. Agents must not be able to raise their own permissions or alter the policy that governs them. Network and data-flow restrictions. Control DNS, direct-IP traffic, cloud-metadata access, and external requests. Distinguish permitted operations and data destinations within approved services; allowing GitHub must not imply allowing private data to be published anywhere on GitHub. A separate production boundary. Let agents propose changes without standing production-write authority. Apply consequential changes through trusted approval and deployment systems that display the actual action being authorized. Controlled software supply chains. Verify provenance, pin approved versions, and review tool and MCP configuration changes. Install dependencies without production credentials. Independent audit and containment. Record actions and enforcement decisions somewhere the agent cannot alter. Support automatic containment and revocation without depending on the agent’s cooperation. Containment must also revoke downstream delegations and permissions already granted, not just stop the initiating process or rotate its credentials. Recommended action Make approved, managed cloud-agent environments the standard path for autonomous development. Inventory existing local agents and extensions, remove unnecessary access, and prohibit personal agent accounts from connecting to sensitive production systems. Require vendors to demonstrate their boundaries: that an agent cannot read service credentials, bypass network controls, expand its permissions, modify audit records, or make unapproved production changes. Verify containment through practical tests, including whether the kill switch actually stops agent activity. For potentially affected Cursor installations, follow the vendor’s incident-response guidance now. Moving future work to the cloud does not remediate an already compromised endpoint [7]. For regulated and government workloads, use only environments authorized for the relevant data and systems. Assess model endpoints, logs, storage, and external tools against residency, retention, contractual, and accreditation requirements. The recommendation is cloud execution backed by verified security controls. The sources reviewed do not establish a comparative breach rate for local versus cloud agents. They establish why isolation, limited authority, credential separation, and independent enforcement matter. Agents’ access should be scoped to the requirements of each task. For a concrete framework to evaluate these controls, see Replit’s proposed Agent Habitat Architecture and its evidence-based maturity scale. It provides a reference architecture for independently enforced permissions, brokered credentials, controlled data flows, and out-of-band containment. Each cloud-agent product should be assessed separately to verify which controls it implements. References [1] Stack Overflow, “AI | 2024 Developer Survey”. Accessed: Nov. 1, 2026. [Online]. Available: https://survey.stackoverflow.co/2024/ai [2] Stack Overflow, “AI | 2025 Developer Survey”. Accessed: Nov. 1, 2026. [Online]. Available: https://survey.stackoverflow.co/2025/ai [3] Salt Security, “Nearly half of enterprises report an AI agent took an unauthorized action last year, Salt Security research finds,” Oct. 13, 2026. Accessed: Nov. 1, 2026. [Online]. Available: https://salt.security/press-releases/state-of-agentic-ai-and-api-security-2h-2026 [4] Cloud Security Alliance, “More than half of organizations experience AI agent scope violations, Cloud Security Alliance study finds,” Apr. 16, 2026. Accessed: Nov. 1, 2026. [Online]. Available: https://cloudsecurityalliance.org/press-releases/2026/04/16/more-than-half-of-organizations-experience-ai-agent-scope-violations-cloud-security-alliance-study-finds [5] V. Elliott, “A defense contractor gave their personal AI agent access to a secure Pentagon system | WIRED”. Accessed: Nov. 1, 2026. [Online]. Available: https://www.wired.com/story/a-defense-contractor-gave-their-personal-ai-agent-access-to-a-secure-pentagon-system/ [6] L. H. Newman, “A supply chain attack put malicious Anthropic Claude extensions on thousands of devices | WIRED”. Accessed: Nov. 1, 2026. [Online]. Available: https://www.wired.com/story/trojan-malware-targets-thousands-of-anthropic-claude-developer-systems/ [7] Cursor, “Claude Code extension security notice,” updated Oct. 30, 2026. Accessed: Nov. 1, 2026. [Online]. Available: https://cursor.com/blog/claude-code-extension-security-notice [8] M. Bar and R. McCarthy, “s1ngularity: Supply chain attack leaks secrets on GitHub: Everything you need to know | Wiz Blog,” Aug. 27, 2025, updated Aug. 29, 2025. Accessed: Nov. 1, 2026. [Online]. Available: https://www.wiz.io/blog/s1ngularity-supply-chain-attack [9] Invariant Labs, GitHub MCP vulnerability research. Accessed: Nov. 1, 2026. [Online]. Available: https://invariantlabs.ai/blog/mcp-github-vulnerability [10] H. Gill, “Our response to the January 2025 Kudelski Security vulnerability disclosure: Action and continuous improvement,” CodeRabbit, Aug. 19, 2025. Accessed: Nov. 1, 2026. [Online]. Available: https://www.coderabbit.ai/blog/our-response-to-the-january-2025-kudelski-security-vulnerability-disclosure-action-and-continuous-improvement [11] Salt Labs, “How we hijacked an AI agent with a single email,” Salt Security, Oct. 1, 2026. Accessed: Nov. 1, 2026. [Online]. Available: https://salt.security/blog/how-we-hijacked-an-ai-agent-with-a-single-email [12] T. Robinson, “The largest theft in history: North Korea behind the $6.4 billion Binance hack,” Elliptic, Oct. 30, 2026, updated Nov. 1, 2026. Accessed: Nov. 1, 2026. Available: https://www.elliptic.co/insights/binance-largest-hack-in-history/