My AI Agent Tried to Install a Typosquatted Package at 3 AM. It Was One Dependency Conflict Away From Owning My Keys

说明与用途

在Raspberry Pi上运行的AI代理几乎因拼写错误安装了恶意的拼写错误包。自定义的包代理验证、允许或拒绝安装请求，记录原因，并强制执行沙箱和出口过滤，以防止系统被入侵。

问题

AI agents can unintentionally install malicious or typosquatted packages, risking compromise of sensitive infrastructure.

结果

The broker prevented the installation of a typosquatted package, caught additional suspicious requests, and reduced retry‑stupidity. Zero malicious installs were observed over eight months.

工作流

• 1. Agent calls pkg_install(name) tool instead of pip directly.
• 2. Broker checks exact‑name allowlist.
• 3. If not allowed, broker performs fuzzy‑match rejection with typo suggestion.
• 4. For new packages, broker queries PyPI JSON API and applies age/popularity gates.
• 5. Unapproved packages enter a human approval queue.
• 6. All actions are logged with the agent’s stated reason.
• 7. Sandbox: agent runs in dedicated user, no sudo, API keys behind a proxy, outbound traffic limited to whitelisted hosts.

证据

The agent had tried to install reqeusts — a typosquat of requests — because it had hallucinated the spelling from a scraped Stack Overflow answer

来源

The broker does five checks before anything touches disk

来源

The agent’s whole runtime lives in a dedicated user account with no sudo, and its tool sandbox runs as that user

来源