Modern-day security tooling looks for the wrong things. Most software composition analysis tools work by checking your dependencies against a database of known vulnerabilities – CVEs. But a deliberately planted backdoor doesn't have a CVE.
大多数安全团队依赖CVE数据库来评估风险，但作者指出这种方法对故意植入的后门完全无效。这一观点挑战了行业共识，暗示现有安全工具在新型供应链攻击面前已经过时，需要转向行为分析等新方法。
Native sandbox support gives developers that execution layer out of the box, instead of forcing them to piece it together themselves.
令人惊讶的是：OpenAI的Agents SDK现在原生支持沙盒执行，开发者无需自己构建执行环境。这意味着AI代理可以在受控环境中安全地运行，包括读取和写入文件、安装依赖项、运行代码和使用工具。这种内置的安全层对于企业级AI应用至关重要，但大多数开发者可能没有意识到其复杂性已经被OpenAI解决了。
Each platform surfaces different vulnerabilities, making it difficult to establish a single, reliable source of truth for what is actually secure.
令人惊讶的是：AI安全工具之间存在不一致性，导致难以确定真正的安全状况。这种混乱局面使得企业面临更大的决策困境，即使有先进的安全工具，也无法保证全面保护，这反映了AI安全领域尚未成熟的现实。