A criminal AI supply chain has established a range of pathways to farm victim API keys and session tokens. One such approach involved masquerading as real AI service providers to deliver malware.
【方法】这一描述揭示了针对AI服务的特定攻击方法，包括冒充合法AI服务提供商和利用评估沙箱漏洞。这些专门针对AI生态系统的攻击方法需要专门的防御策略，反映了威胁环境的快速演变。
The operators treated the AI supply chain itself as both a target and a resource. They stole AI API keys from multiple target environments and used them to provide additional AI compute.
【数据】这一观察揭示了AI供应链已成为新的攻击目标，操作者将被盗的API密钥同时作为目标资源和计算资源使用。这种双重利用模式显示了AI安全威胁的复杂性和多层次性。
We are building a world where machines write the code, machines choose the dependencies, and machines ship the updates. The AI agents are building the software. If we don't secure the supply chain they rely on, the AI agents are cooked.
大多数人认为AI将提高软件开发的效率和安全性，但作者警告说，如果我们不保护AI代理所依赖的供应链，这些代理本身就会成为攻击目标。这挑战了AI发展必然带来安全提升的主流观点，提出了一个反直觉的警告。