构建 AI Agent 和测试其安全性真的必须用 Python 吗？

Ask anyone how to get started with AI agents and you'll hear the same answer: "Learn Python." It's good advice, but it's not the whole story. In 2026 you can build a working agent in TypeScript, orchestrate one visually without writing much code, and run a serious security assessment driven mostly by YAML files. So is Python indispensable? The honest answer: not for building, almost for breaking. Let's look at why. Part 1: Building agents An agent is a loop: a model receives a goal, decides on an action, calls a tool, reads the result, and decides again. That loop can be written in any language that can make an HTTP request and parse JSON. Where Python shines Python still has the deepest ecosystem: LangChain, LangGraph, LlamaIndex, CrewAI, AutoGen, and most vendor SDKs ship Python first. Local inference tooling (transformers, vLLM, llama-cpp bindings) is Python-native. If you want to fine-tune a small model or plug a custom embedding pipeline into your agent's memory, Python is the path of least resistance. Where Python is optional TypeScript/JavaScript: LangChain.js, the Vercel AI SDK, Mastra and the OpenAI Agents SDK for JS all support tool calling, streaming and multi-step agents. If your agent lives inside a web app, staying in TS avoids a second runtime. Other languages: Go, Rust, Java and C# have official or community SDKs for the major model APIs. Tool calling is just structured JSON. Low-code orchestration: tools like n8n let you wire a model, tools and memory together visually. Useful for prototypes and internal automations. MCP (Model Context Protocol): tools exposed through MCP servers are language-agnostic. Your agent in TS can call a tool written in Python, and vice versa. Verdict for building: Python is the default, not a requirement. Pick the language your product already runs on. Part 2: Testing agent security This is where the picture changes. Agents are a bigger attack surface than chatbots: they read untrusted content, hold credentials and take actions. A successful prompt injection against a chatbot produces a bad answer; against an agent, it can produce a bad action. See the attack surface breakdown in AI agent security. What you actually need to test Direct and indirect injection: can a web page, email or document the agent reads override its instructions? Tool abuse: can the agent be steered into calling a tool with attacker-controlled parameters? Data exfiltration: can it be tricked into leaking its system prompt, secrets or user data? Goal hijacking over many turns: does the agent drift when pressure builds gradually? Retrieval poisoning: if it uses RAG, can a planted document change its behavior? (More on auditing RAG systems.) The tooling landscape garak (Python): a scanner that probes models for jailbreaks, injection, leakage and more. PyRIT (Python): Microsoft's framework for orchestrating automated, multi-turn attacks. DeepTeam (Python): red teaming built around LLM vulnerability categories. promptfoo (Node.js): configuration-driven evals and red teaming, mostly written in YAML. You can run a meaningful assessment here without writing Python. So you can start without Python. But the moment you go beyond off-the-shelf probes, Python becomes hard to avoid. Why red teaming pulls you toward Python Real AI red teaming is not running a scanner once. It's an adversarial loop: generate an attack, send it, score the response, mutate, repeat. Increasingly, one model attacks another. Building that loop, writing custom scorers, replaying multi-turn scenarios and analyzing results in bulk (pandas, notebooks) is where Python's ecosystem pays off. And there's a practical reason: most published research, proof-of-concept attacks and datasets in adversarial ML come as Python code. If you can't read it, you can't reproduce it. Verdict for security: you can scan without Python. You can't really red team without it. Pentest vs red teaming: which one do you need? A classic pentest checks the application around the agent: authentication, APIs, permissions, secrets handling. Language-agnostic, standard AppSec tooling. Red teaming targets the model's behavior itself. Most agent deployments need both. Here is a breakdown of pentest vs red teaming for AI systems. A pragmatic path You're a web developer: build your agent in TypeScript. Start security testing with promptfoo. Learn enough Python to read and run garak or PyRIT. You're a security professional: your existing pentest skills cover the app layer. Add Python for automating attack loops and scoring. You're starting from zero: learn Python. It's the shortest path to both building and breaking. Don't forget the framework Tools find vulnerabilities; frameworks tell you what to test and how to report it. OWASP's Top 10 for LLM Applications, MITRE ATLAS, NIST AI RMF and the EU AI Act all shape what a credible assessment looks like. An overview of the AI security frameworks helps you scope an AI audit. And always test within a written mandate: see ethical AI hacking. Conclusion Python isn't a gate to building AI agents: any language that speaks JSON can do it. But securing agents is an adversarial, experimental discipline, and that discipline lives in Python. Build in whatever you like. Learn Python to break it. More on offensive AI security at Wasa Confidence.