Event ·Official first-hand

AI编程代理配置供应链缺陷研究

研究分析了3171个GitHub仓库中的AI编程代理配置，包括Claude Code、Cursor、GitHub Copilot和OpenAI Codex。研究发现16.0%的配置存在安全缺陷，9.8%的配置安装了未固定版本的MCP服务器，3.1%的配置预批准了看似有范围的任意执行权限。研究团队通过独立实现和语言模型裁决验证了所有发现。

Current read

GitHub上16%的AI编程代理配置存在安全漏洞，开发者需警惕MCP服务器版本固定问题。

11 sources73° AI heatLast updated 2026/9/7 11:27:24

Evidence

11 sources

Primary sourcearXiv: OpenAI

2026/9/7 11:27:24View source

Related source 1shao__meng

2026/9/8 01:53:12View source

Related source 2lmarena.ai

2026/9/5 17:40:41View source

Related source 3小互

2026/9/8 07:59:52View source

Related source 4Lenny Rachitsky

2026/9/8 17:00:32View source

Related source 5IT之家

2026/9/9 09:34:47View source

Related source 6Gary Marcus

2026/9/5 12:44:18View source

Related source 7宝玉

2026/9/5 17:06:13View source

Related source 8OpenAI Blog

2026/9/6 08:00:00View source

Related source 9Sam Altman

2026/9/6 17:11:01View source

Related source 10Greg Brockman

2026/9/7 02:55:55View source

Conflict check

Dedup data only shows that these sources discuss the same event, not that they agree. There is no structured supporting or refuting evidence yet, so no conflict is inferred automatically.

Open the story