My AI Agent Tried to Install a Typosquatted Package at 3 AM. It Was One Dependency Conflict Away From Owning My Keys

Описание и применение

AI‑агент на Raspberry Pi почти установил вредоносный пакет из-за опечатки в названии. Внедренный «брокер» пакетов проверяет и одобряет установки, блокируя сомнительные запросы, и обеспечивает изоляцию и аудит.

Задача

AI agents can unintentionally install malicious or typosquatted packages, risking compromise of sensitive infrastructure.

Результат

The broker prevented the installation of a typosquatted package, caught additional suspicious requests, and reduced retry‑stupidity. Zero malicious installs were observed over eight months.

Рабочий процесс

• 1. Agent calls pkg_install(name) tool instead of pip directly.
• 2. Broker checks exact‑name allowlist.
• 3. If not allowed, broker performs fuzzy‑match rejection with typo suggestion.
• 4. For new packages, broker queries PyPI JSON API and applies age/popularity gates.
• 5. Unapproved packages enter a human approval queue.
• 6. All actions are logged with the agent’s stated reason.
• 7. Sandbox: agent runs in dedicated user, no sudo, API keys behind a proxy, outbound traffic limited to whitelisted hosts.

Доказательства

The agent had tried to install reqeusts — a typosquat of requests — because it had hallucinated the spelling from a scraped Stack Overflow answer

Источник

The broker does five checks before anything touches disk

Источник

The agent’s whole runtime lives in a dedicated user account with no sudo, and its tool sandbox runs as that user

Источник