智能体
dev.to ·
@Ali-Funk
AI 安全是零信任问题，而非哲学辩论
文章认为，围绕前沿实验室人员离职的生存风险讨论虽重要，但不能替代基础设施策略。现代 AI 系统中 Agent 会委派任务、调用外部工具并派生新 Agent，终止原始运行时往往无法终止下游进程；单个合法的 API 调用也可能组合出未授权目标，静态 IAM 角色和传统网络边界因此失效。作者主张将零信任直接应用于 AI 运行时：对每个 Agent 动作持续动态风险评分、在每个网络跳点做状态加密验证、对计算/网络/工具访问设置硬性执行限额、要求不可变运行时证据而非依赖模型自述，并默认将每个 Agent 视为对抗性。文章引用 OWASP Agentic Applications Top 10 和 OWASP Agent Control Standard，强调系统安全不能只依赖模型行为，需要刚性基础设施边界。
AI推荐理由 文章提出将 Zero Trust 原则直接应用于 AI Agent 运行时，并给出持续动态风险评分、逐跳状态加密验证、硬性执行限额、不可变运行时证据、默认将 Agent 视为对抗性等具体工程建议，还引用 OWASP Agentic Applications Top 10 与 OWASP Agent Control Standard 作为依据。其价值在于把 Agent 安全从对齐哲学讨论转向基础设施边界设计，对 Agent 部署有实际参考意义；但内容为观点性论述，未提供实测数据或可验证案例，引用来源也仅以列表形式给出，无法核实具体细节，因此质量分中等。
62
正文
The reaction to Jacob Coxon leaving Anthropic centers on existential risk. That debate matters.
But existential risk is not an infrastructure strategy.
Frontier lab insiders discuss catastrophic AI risks.
This conversation remains incomplete.
Modern AI systems expose the limits of static IAM roles and traditional network perimeters. Agents delegate work. They invoke external tools.
They spawn additional agents. Terminating the original runtime rarely terminates these downstream processes.
An agent expresses an unauthorized objective through individually valid API calls. Static allowlists validate the request without understanding the cumulative intent.
We must apply Zero Trust directly to the AI runtime.
• Implement continuous dynamic risk scoring for every agent action.
• Enforce cryptographic validation of state at every network hop.
• Deploy hard execution limits for compute, network and tool access.
• Demand immutable runtime evidence over model self reporting.
• Treat every agent as adversarial by default.
Model alignment solves one problem. Infrastructure security solves another.
An aligned model can operate inside an architecture with excessive permissions. A misaligned model can operate safely inside secure infrastructure when its capabilities are constrained.
This is defense in depth.
The OWASP Top 10 for Agentic Applications identifies goal hijacking and tool misuse among the critical security risks facing agentic systems.
The new OWASP Agent Control Standard targets runtime enforcement directly.
System safety cannot depend on model behavior alone.
It requires rigid infrastructure boundaries.
Existential risk warnings might produce better policy.
That debate changes nothing about the engineering requirement.
The industry is moving toward increasingly autonomous agents.
We must design runtimes that enforce strict boundaries.
A compromised agent must never escape those limits.
Infrastructure first. Philosophy second.
Sources
Technical and security
Wall Street Journal: The Anonymous Math Geek Who Quit Anthropic—and Became the Face of AI Safety (Sept. 2026)
OWASP Top 10 for Agentic Applications (2026)
OWASP Agent Control Standard (released Sept. 1, 2026)
Cloud Security Alliance: Zero Trust Working Group
Context
CNET: How AI Doomsday Talk Is Making Tech Giants More Powerful, Not Safer
Lever News: Under Cover Of AI Doomsday, Big Tech Is Writing Its Own Rules
The Register: Big AI sets out its terms for regulatory capture and calls it “Pace the frontier”