Agentjacking 攻击深度解析：AI 编程代理的新型安全威胁

// mcp-content-guard.ts - MCP 内容安全分级中间件
import { createHash } from 'crypto';

interface ContentClassification {
  level: 'L1' | 'L2' | 'L3';
  sanitized: string;
  warnings: string[];
  blocked: boolean;
}

class MCPContentGuard {
  private trustedSources: Set<string>;
  private suspiciousPatterns: RegExp[];

  constructor(trustedSources: string[]) {
    this.trustedSources = new Set(trustedSources);
    this.suspiciousPatterns = [
      /(?:ignore|disregard|forget)\s+(?:previous|all|above)/i,
      /(?:execute|run|fetch|download)\s+(?:this|the following|remote)/i,
      /\b(?:curl|wget|Invoke-WebRequest)\b.*https?:\/\//i,
      /\beval\s*\(/i,
      /<script[\s>]/i,
      /\[.*?\]\(javascript:/i,
    ];
  }

  classify(content: string, source: string): ContentClassification {
    const warnings: string[] = [];
    let blocked = false;

    // 检查来源信任级别
    const isTrusted = this.trustedSources.has(source);

    // 检测可疑模式
    for (const pattern of this.suspiciousPatterns) {
      const match = content.match(pattern);
      if (match) {
        warnings.push(`Suspicious pattern detected: ${match[0]}`);
        blocked = true;
      }
    }

    // 检测 Markdown 中嵌入的可执行内容
    const codeBlockCount = (content.match(/```/g) || []).length;
    if (codeBlockCount > 5) {
      warnings.push(`Unusually high code block count: ${codeBlockCount}`);
    }

    // 确定安全级别
    let level: 'L1' | 'L2' | 'L3';
    if (blocked) {
      level = 'L3';
    } else if (isTrusted) {
      level = 'L1';
    } else {
      level = 'L2';
    }

    return {
      level,
      sanitized: blocked ? this.sanitize(content) : content,
      warnings,
      blocked,
    };
  }

  private sanitize(content: string): string {
    // 移除可疑的指令性内容，保留纯信息部分
    return content
      .replace(this.suspiciousPatterns[0], '[FILTERED]')
      .replace(/<script[\s\S]*?<\/script>/gi, '[FILTERED]')
      .replace(/\[.*?\]\(javascript:.*?\)/gi, '[FILTERED]');
  }

  // 生成内容指纹用于审计
  fingerprint(content: string): string {
    return createHash('sha256').update(content).digest('hex').slice(0, 16);
  }
}

// 检测 Markdown 中的可疑指令模式
function detectSuspiciousInstructions(content: string): {
  score: number;
  matches: string[];
} {
  const patterns = [
    /(?:please|now|ignore previous|disregard).*?(?:execute|run|fetch|download)/i,
    /(?:curl|wget|Invoke-WebRequest|fetch)\\s+https?:\\/\\//i,
    /(?:eval|exec|spawn|child_process)\\s*\\(/i,
    /<script[\\s\\S]*?>[\\s\\S]*?<\\/script>/i
  ];

  const matches: string[] = [];
  for (const pattern of patterns) {
    const found = content.match(pattern);
    if (found) matches.push(found[0]);
  }

  return {
    score: matches.length / patterns.length,
    matches,
  };
}

# ai-agent-sandbox.yaml
sandbox:
  filesystem:
    allowed_paths:
      - ./src/**
      - ./tests/**
      - ./package.json
    denied_paths:
      - ~/.ssh/**
      - ~/.aws/**
      - ~/.env*
      - /etc/**
      - /usr/**
    max_write_size: 1MB
    require_confirm_above: 100KB

  network:
    allowed_domains:
      - registry.npmjs.org
      - github.com
      - api.sentry.io
    denied_patterns:
      - "*.onion"
      - "localhost:*"  # 防止反向 Shell
    max_requests_per_minute: 30

  process:
    allowed_commands:
      - npm run *
      - npx tsc
      - node --test
    denied_commands:
      - curl * | sh
      - wget * | bash
      - eval *
      - python -c *

interface AgentActionLog {
  timestamp: string;
  sessionId: string;
  agentId: string;
  action: 'file_read' | 'file_write' | 'terminal_exec' | 'network_request' | 'mcp_call';
  target: string;           // 文件路径/URL/MCP 工具名
  parameters: Record<string, unknown>;
  result: 'success' | 'denied' | 'error';
  riskScore: number;        // 0-100 风险评分
  triggeredRules: string[]; // 触发的安全规则
  userConfirmed: boolean;   // 是否经过用户确认
}