网络安全行业正在超越传统沙盒的范围，以控制功能强大的AI代理，因为越来越多的事件暴露了现有防御的局限性。
The cybersecurity industry is looking beyond traditional sandboxes to keep powerful AI agents under control as a growing number of incidents expose the limits of existing defenses.
为什么重要：AI代理正在变得越来越擅长寻找绕过其限制的方法，迫使安全领导者和研究人员重新思考如何在不限制其有用性的前提下控制这些系统。
Why it matters: AI agents are getting better at finding ways around their restrictions, forcing security leaders and researchers to rethink how to keep these systems under control without limiting their usefulness.
推动新闻：微软首席执行官萨蒂亚·纳德拉在周末的一篇X平台文章中警告称，行业不能依赖“一套嵌套的黑盒子，然后简单地接受或拒绝其建议、答案和行动”来保障AI模型的安全。
Driving the news: Microsoft CEO Satya Nadella warned in an essay on X over the weekend that the industry cannot rely on "a set of nested black boxes and simply accept or reject its recommendations, answers, and actions" to secure AI models.
“我们必须构建可控系统，使其行为可观察、限制可测试、行动始终可控，”纳德拉补充道。
"We must build contained systems whose behavior we can observe, limits we can test, and actions we can always contain," Nadella added.
多位安全和企业软件领导者——包括帕洛阿尔托网络首席执行官尼克什·阿罗拉和Box首席执行官亚伦·莱维——迅速表示支持纳德拉的担忧。
Several security and enterprise software leaders — including Palo Alto Networks CEO Nikesh Arora and Box CEO Aaron Levie — were quick to back Nadella's concerns.
他的言论紧随Anthropic和OpenAI关于AI代理在测试期间超出指令采取行动的新披露之后。
His comments followed new disclosures from Anthropic and OpenAI about AI agents taking actions outside their instructions during testing.
大局：传统沙盒将软件与敏感系统隔离，但AI代理通常需要访问外部工具、数据和网络以完成其任务。这种访问可能使代理采取非预期行动，即使它们没有突破沙盒。
The big picture: Traditional sandboxes isolate software from sensitive systems, but AI agents often need access to outside tools, data and networks to complete their tasks. That access can allow agents to take unintended actions, even without breaking out of their sandboxes.
现在，开发者需要弄清楚如何限制这种第三方工具和数据访问，同时不阻碍代理完成其工作。
Now, developers have to figure out how to limit that third-party tool and data access without preventing agents from doing their jobs.
聚焦：上周在进攻性AI会议上，研究人员展示了测试AI代理是否遵循指令以及如何约束其行为的新方法。
Zoom in: During the Offensive AI Conference last week, researchers demonstrated new ways to test whether AI agents follow their instructions and ways to rein in their behavior.
Dreadnode的研究人员推出了ScopeBench，这是一种新测试，用于衡量AI代理在黑客任务期间是否遵守限制，即使违反这些规则可能有助于它们成功。
Researchers at Dreadnode unveiled ScopeBench, a new test that measures whether AI agents follow restrictions during hacking assignments, even when breaking those rules would help them succeed.
SpecterOps 的对抗模拟顾问马修·尼克森演示了一套测试框架，用于追踪 AI 代理在模拟企业网络中的导航情况，包括它们使用的工具、执行的操作以及消耗的令牌数量。
Matthew Nickerson, an adversary simulation consultant at SpecterOps, demonstrated a testing framework that tracks how AI agents navigate simulated corporate networks, including the tools they use, the actions they take and how many tokens they consume.
在深层次：Perplexity 的研究员齐比·布兰尼茨基对《Axios》表示，保障 AI 代理的安全需要结合传统网络安全实践，包括零信任原则，以及考虑代理运行所需灵活性的新控制措施。
Between the lines: Securing AI agents requires a mix of traditional cybersecurity practices, including zero-trust principles, and new controls that account for the flexibility agents need to operate, Zibi Braniecki, a researcher at Perplexity, told Axios.
他的团队正在开发更精准的控制措施，以限制代理可访问的内容，同时构建独立的 AI 系统来监控其行为并标记潜在的未授权操作。
His team is developing more precise controls over what agents can access, as well as independent AI systems that monitor their actions and flag potentially unauthorized behavior.
“你不能仅靠一个‘开-关’的开关来解决这个问题，必须涉及更多内容，”布兰尼茨基说。“需要一个更细致入微的系统。”但：布兰尼茨基警告称，随着 AI 代理能力的提升，保障其安全的最佳方法可能在未来几个月内发生变化。
"You cannot solve it by a knob of 'on-off,' there has to be a little bit more involved," Braniecki said. "There has to be a more nuanced system." Yes, but: Braniecki warned that the best approaches to securing AI agents could change in the coming months as their capabilities advance.
“这就是站在前沿的魅力所在——我们在行动中学习我们正在做的事情，”他说。
"That's part of the beauty of living on the edge is that we're learning what we're doing as we're going," he said.
核心观点：安全行业必须弄清楚如何控制能力尚未完全被理解的 AI 代理，同时又不能剥夺使其有用的自由度。
The bottom line: The security industry must figure out how to control AI agents whose capabilities are still not fully understood, without stripping them of the freedom that makes them useful.