[{"data":1,"prerenderedAt":235},["ShallowReactive",2],{"copy:zh:site:":3,"copy:zh:security:list,ui,incidents.2025-04-mcp-tool-poisoning.title,incidents.2025-04-mcp-tool-poisoning.summary,incidents.2025-04-mcp-tool-poisoning.tags,incidents.2025-05-github-mcp-toxic-agent-flow.title,incidents.2025-05-github-mcp-toxic-agent-flow.summary,incidents.2025-05-github-mcp-toxic-agent-flow.tags,incidents.2025-06-echoleak-m365-copilot.title,incidents.2025-06-echoleak-m365-copilot.summary,incidents.2025-06-echoleak-m365-copilot.tags,incidents.2025-06-mcp-inspector-rce.title,incidents.2025-06-mcp-inspector-rce.summary,incidents.2025-06-mcp-inspector-rce.tags,incidents.2025-07-filesystem-mcp-escaperoute.title,incidents.2025-07-filesystem-mcp-escaperoute.summary,incidents.2025-07-filesystem-mcp-escaperoute.tags,incidents.2025-07-supabase-mcp-token-leak.title,incidents.2025-07-supabase-mcp-token-leak.summary,incidents.2025-07-supabase-mcp-token-leak.tags,incidents.2025-07-mcp-remote-os-command-injection.title,incidents.2025-07-mcp-remote-os-command-injection.summary,incidents.2025-07-mcp-remote-os-command-injection.tags,incidents.2025-07-amazon-q-wiper-prompt.title,incidents.2025-07-amazon-q-wiper-prompt.summary,incidents.2025-07-amazon-q-wiper-prompt.tags,incidents.2025-09-postmark-mcp-backdoor.title,incidents.2025-09-postmark-mcp-backdoor.summary,incidents.2025-09-postmark-mcp-backdoor.tags,incidents.2026-01-openclaw-control-ui-rce.title,incidents.2026-01-openclaw-control-ui-rce.summary,incidents.2026-01-openclaw-control-ui-rce.tags,incidents.2026-01-moltbook-database-exposure.title,incidents.2026-01-moltbook-database-exposure.summary,incidents.2026-01-moltbook-database-exposure.tags,incidents.2026-openclaw-gateways-exposed.title,incidents.2026-openclaw-gateways-exposed.summary,incidents.2026-openclaw-gateways-exposed.tags,incidents.2026-02-clawhavoc-malicious-skills.title,incidents.2026-02-clawhavoc-malicious-skills.summary,incidents.2026-02-clawhavoc-malicious-skills.tags,incidents.2026-02-mcp-typescript-sdk-response-leak.title,incidents.2026-02-mcp-typescript-sdk-response-leak.summary,incidents.2026-02-mcp-typescript-sdk-response-leak.tags,incidents.2026-04-comment-and-control-ci-secrets.title,incidents.2026-04-comment-and-control-ci-secrets.summary,incidents.2026-04-comment-and-control-ci-secrets.tags,incidents.2026-06-mcp-python-sdk-session-hijack.title,incidents.2026-06-mcp-python-sdk-session-hijack.summary,incidents.2026-06-mcp-python-sdk-session-hijack.tags,incidents.2026-06-claude-code-webfetch-exfiltration.title,incidents.2026-06-claude-code-webfetch-exfiltration.summary,incidents.2026-06-claude-code-webfetch-exfiltration.tags":123,"copy:zh:site:common":233},{"common":4,"nav":16,"footer":44,"home":51,"error":116},{"skip":5,"menu":6,"language":7,"sections":8,"footer":9,"tool":10,"home":11,"breadcrumbs":12,"copy":13,"copied":14,"download":15},"跳转到正文","菜单","语言","章节","页脚","工具","首页","面包屑导航","复制","已复制","下载",{"groups":17,"items":25},{"build":18,"connect":19,"instruct":20,"run":21,"web":22,"secure":23,"track":24},"构建","连接","编写指令","运行","开放你的网站","安全","跟踪",{"models":26,"cost":27,"frameworks":28,"mcp":29,"mcpConfig":30,"mcpClients":31,"agentsMd":32,"files":33,"openclaw":34,"agentReady":35,"llmsTxt":36,"robotsTxt":37,"apiCatalog":38,"bots":39,"security":40,"incidents":41,"checklist":42,"changelog":43},"模型与 API 价格","Agent 成本计算器","框架与 SDK","MCP 服务器","MCP 配置生成器","MCP 客户端","AGENTS.md 生成器","指令文件","自托管 OpenClaw","适配 Agent 的网站","llms.txt 生成器","面向 AI 机器人的 robots.txt","API 目录生成器","AI 机器人目录","Agent 安全","事故记录","安全检查清单","更新日志",{"about":45,"privacy":46,"terms":47,"sitemap":48,"disclaimer":49,"checked":50},"关于","隐私","条款","网站地图","为 AI agent 开发者提供的独立参考资料。与此处提及的任何厂商均无关联。","事实核查日期：{date}",{"seo":52,"eyebrow":55,"title":56,"lead":57,"ctaMcp":58,"ctaCost":59,"ctaAgents":60,"sheetLabel":61,"sheetTitle":62,"sheet":63,"sheetNote":69,"sectionsTitle":70,"sections":71,"latestTitle":99,"allChanges":100,"rulesTitle":101,"rules":102,"aboutLink":115},{"title":53,"description":54},"DotsAgent：构建 AI agent 的参考资料与工具","LLM API 价格、agent 成本计算器、适用于 13 个客户端的 MCP 配置、AGENTS.md 和 llms.txt 生成器，以及 agent 安全指南。免费提供，支持 18 种语言。","面向 AI agent 开发者","Agent 开发者的案头参考","涵盖 agent 开发所需的价格、协议、配置文件和安全指南，所有信息均经厂商官方文档核实。查找信息、生成所需文件，然后继续编写代码。","生成 MCP 配置","计算 agent 任务成本","编写 AGENTS.md","最新数据","技术栈概览",{"mcp":64,"openclaw":65,"cheapest":66,"models":67,"servers":29,"bots":68},"MCP 规范","OpenClaw","最低价模型，$\u002F百万输入\u002F输出 tokens","已统计价格的模型","已跟踪的 AI 机器人","每项数据均经人工对照厂商文档核实。","网站内容",{"models":72,"mcp":76,"instructions":79,"frameworks":82,"openclaw":85,"agentReady":88,"security":92,"changelog":95},{"title":73,"body":74,"unit":75},"模型与价格","并列比较每百万输入、输出和缓存 token 的价格，并提供计算器，估算完整 agent 运行的费用。","个模型",{"title":29,"body":77,"unit":78},"Model Context Protocol 服务器目录，以及配置生成器，可为每种客户端生成对应的配置文件。","台服务器",{"title":33,"body":80,"unit":81},"编写 AGENTS.md，并了解各工具如何读取 CLAUDE.md、.cursor\u002Frules 等类似文件。","种文件格式",{"title":28,"body":83,"unit":84},"按语言、许可证、MCP 支持和多 agent 功能对比 agent 框架与厂商 SDK。","个框架",{"title":34,"body":86,"unit":87},"逐步指导你在自己的设备或服务器上安装、配置和更新 OpenClaw。","当前版本",{"title":89,"body":90,"unit":91},"适配 agent 的网站","生成 llms.txt、面向 AI crawler 的 robots.txt 规则和 api-catalog，并通过 user agent 查询任意机器人。","个已收录机器人",{"title":40,"body":93,"unit":94},"了解 agent 面临的 OWASP 风险、真实事件记录，以及上线前可逐项核对的清单。","起已记录事件",{"title":96,"body":97,"unit":98},"API 更新日志","按日期记录模型 API、SDK 和协议的变更，并附上厂商公告链接。","条记录","最新变更","所有变更","我们如何确保信息准确",[103,106,109,112],{"title":104,"body":105},"事实均有来源。","每项价格、版本和 flag 都链接到对应的供应商页面，方便你自行核实。",{"title":107,"body":108},"定期核查。","每个页面都会显示上次核查信息的时间；过时的条目会重新核查或移除。",{"title":110,"body":111},"不接受付费推广。","没有人能付费获得收录、提高排名或得到更好的描述。",{"title":113,"body":114},"工具在浏览器中运行。","生成器和计算器都在本地运行，你输入的内容不会发送到服务器。","关于 DotsAgent",{"title":117,"body":118,"home":119,"popular":120,"failed":121,"failedBody":122},"找不到页面","此地址没有对应的页面。页面可能已迁移，或者链接中有拼写错误。","前往首页","热门工具","出了点问题","我们这边未能加载此页面。请稍后再试，或从首页开始浏览。",{"list":124,"ui":132,"incidents":135},{"seo":125,"crumb":128,"eyebrow":129,"title":130,"lead":131},{"title":126,"description":127},"智能体安全事件记录：自 2025 年以来共 17 起","自 2025 年 4 月以来公开的 AI agent 安全事件，涵盖 MCP 工具投毒、Claude Code WebFetch 数据外泄等；每起事件均附有 CVE、根本原因和修复措施。","事件记录","自 2025 年以来的 {n} 起事件","Agent 安全事件记录","按时间从近到远列出涉及 AI agent、MCP server 和 agent 平台的公开事件。每条记录都会说明事件经过、攻击得以奏效的原因，以及你可以如何调整自己的配置。",{"crumb":133,"sources":134},"智能体安全","来源",{"2025-04-mcp-tool-poisoning":136,"2025-05-github-mcp-toxic-agent-flow":143,"2025-06-echoleak-m365-copilot":148,"2025-06-mcp-inspector-rce":154,"2025-07-filesystem-mcp-escaperoute":160,"2025-07-supabase-mcp-token-leak":166,"2025-07-mcp-remote-os-command-injection":172,"2025-07-amazon-q-wiper-prompt":178,"2025-09-postmark-mcp-backdoor":184,"2026-01-openclaw-control-ui-rce":189,"2026-01-moltbook-database-exposure":194,"2026-openclaw-gateways-exposed":200,"2026-02-clawhavoc-malicious-skills":206,"2026-02-mcp-typescript-sdk-response-leak":211,"2026-04-comment-and-control-ci-secrets":217,"2026-06-mcp-python-sdk-session-hijack":222,"2026-06-claude-code-webfetch-exfiltration":226},{"title":137,"summary":138,"tags":139},"MCP 工具投毒：工具描述中的隐藏指令","Invariant Labs 展示了 MCP server 如何在模型读取的工具描述中隐藏指令，并介绍了工具影子攻击和 rug pull 变体。",[140,141,142],"MCP","提示词注入","供应链",{"title":144,"summary":145,"tags":146},"GitHub MCP 恶意 agent 流程通过公开 issue 泄露私有仓库数据","Invariant Labs 展示了攻击者如何利用恶意的公开 GitHub issue 引导 GitHub MCP server 上的 agent，将私有仓库数据复制到公开 pull request 中。",[140,141,147],"数据外泄",{"title":149,"summary":150,"tags":151},"EchoLeak：Microsoft 365 Copilot 遭遇零点击数据窃取","一封经过精心构造的邮件就能让 Microsoft 365 Copilot 泄露数据，用户无需点击任何内容。Aim Security 将此漏洞报告为 EchoLeak；Microsoft 已在服务器端修复。",[152,147,153],"prompt 注入","Copilot",{"title":155,"summary":156,"tags":157},"MCP Inspector 代理可被浏览器用于远程代码执行","0.14.1 之前的 MCP Inspector 会启动一个无身份验证的本地代理，网页可访问该代理并在开发者的机器上执行代码。CVSS 9.4。",[140,158,159],"RCE","开发者工具",{"title":161,"summary":162,"tags":163},"EscapeRoute：Filesystem MCP 服务器沙箱逃逸","Cymulate 在 Anthropic 的 Filesystem MCP 服务器中发现了沙箱逃逸和符号链接绕过漏洞，攻击者可借此访问授权目录之外的文件。",[140,164,165],"沙箱逃逸","文件访问",{"title":167,"summary":168,"tags":169},"Supabase MCP 智能体通过支持工单泄露 token","支持工单中的提示注入使 Cursor 智能体读取并泄露了集成 token 表；该智能体通过 service_role 密钥连接到 Supabase MCP。",[140,170,171],"提示注入","致命三要素",{"title":173,"summary":174,"tags":175},"mcp-remote 通过 authorization_endpoint 注入 OS 命令","mcp-remote 0.0.5 至 0.1.15 可能执行恶意 MCP 服务器在 authorization_endpoint 值中植入的 OS 命令。CVSS 评分为 9.6，已在 0.1.16 中修复。",[140,176,177],"远程代码执行","OAuth",{"title":179,"summary":180,"tags":181},"Amazon Q Developer 扩展中包含擦除数据的提示词","VS Code 版 Amazon Q Developer 1.84.0 随附了一个旨在擦除数据的注入提示词。AWS 将问题追溯到 CodeBuild 中权限范围过大的 GitHub token。",[142,182,183],"CI","凭据",{"title":185,"summary":186,"tags":187},"postmark-mcp：恶意 MCP 服务器暗中复制所有邮件","npm 上的 postmark-mcp 1.0.16 会悄悄将其处理的每封邮件密送给攻击者。Koi Security 称这是已知的首个恶意 MCP 服务器。",[140,142,188],"npm",{"title":190,"summary":191,"tags":192},"OpenClaw Control UI 泄露 gateway token，导致一键 RCE","OpenClaw 的 Control UI 信任 gatewayUrl 查询参数，导致 gateway token 泄露并可一键触发 RCE，即使安装仅绑定到 loopback 也不例外。CVSS 8.8。",[65,158,193],"token 窃取",{"title":195,"summary":196,"tags":197},"Moltbook 数据库泄露 1.5M 个 agent API token","面向 OpenClaw agent 的社交网络 Moltbook 未对其 Supabase 数据库启用行级安全，导致约 1.5M 个 API token、35k 个邮箱地址和私信暴露。",[198,199,65],"数据泄露","Supabase",{"title":201,"summary":202,"tags":203},"大量 OpenClaw 网关暴露于互联网","Censys 统计显示，2026 年 1 月 31 日有 21,639 个 OpenClaw 网关可从公共互联网访问；OpenA2A 的索引显示，9 月 1 日这一数字达到 192,492。",[65,204,205],"暴露","配置",{"title":207,"summary":208,"tags":209},"ClawHavoc：数百个恶意 ClawHub skills 传播 AMOS","Koi Security 在 ClawHub 的 2,857 个 skills 中发现 341 个恶意项，大多数会投放 Atomic macOS Stealer。到 2026 年 2 月 16 日，恶意 skills 数量已达到 824 个。",[65,142,210],"恶意软件",{"title":212,"summary":213,"tags":214},"MCP TypeScript SDK 在客户端之间泄露响应","使用 MCP TypeScript SDK 构建的 MCP 服务器如果让多个客户端共用同一个服务器或 transport 实例，就可能把一个客户端的响应发送给另一个客户端。此问题已在 1.26.0 中修复。",[140,215,216],"SDK","会话隔离",{"title":218,"summary":219,"tags":220},"评论与控制：PR 文本窃取 CI Agent 的机密","pull request 和 issue 文本中的提示注入窃取了 Claude Code Security Review、Gemini CLI Action 和 GitHub Copilot Agent 的 CI 机密。",[182,170,221],"机密",{"title":223,"summary":224,"tags":225},"MCP Python SDK 会话劫持与跨会话任务访问","MCP Python SDK 中的两个漏洞可能导致会话劫持，以及访问属于其他会话的任务。SDK 1.27.2 已修复这两个漏洞。",[140,215,216],{"title":227,"summary":228,"tags":229},"Claude Code 的 WebFetch 自动批准功能可通过 huggingface.co 外传数据","Claude Code 0.2.54 至 2.1.163 会自动批准发往 huggingface.co 的 WebFetch 请求，因此托管在该网站上的恶意内容可能将会话数据带出。",[230,231,232],"Claude Code","数据外传","出站流量",{"common":234},{"skip":5,"menu":6,"language":7,"sections":8,"footer":9,"tool":10,"home":11,"breadcrumbs":12,"copy":13,"copied":14,"download":15},1790863382251]