Security Firewall for Agents — Ryan Dahl, Deno

频道: AI Engineer
视频: https://www.youtube.com/watch?v=MkRYPFIMCSA
原文语言: en
统计: 共 22 轮 · Ryan 18 · 观众 1

[0:13] Ryan

How's it going?

大家好啊？

[0:16] Ryan

Um, my name is Ryan. Um, I'm going to I I'm I'm the CEO at Dino and uh yeah, you been developing software for for quite a while at this point. You might know one of my projects, Node.js. Um, I want to talk about um a service that we're running at Dino called Dino Deploy. This is a system for hosting websites and it has incidences. It's it it has downtime occasionally and uh we've got a pager duty that fires. I'm sure you're all very familiar with the very scary alarm sound that wakes you up in the middle of the night. Um, and recently we've been playing around with using agents to automatically service these incidences. Um, in particular, OpenClaw, but other other agents as well. Um, and we've found a pattern that is working pretty well for us that I want to share with you. Um, we actually give OpenClaw access to all sorts of systems. Postgress, Kubernetes, Clickhouse, AWS, GitHub, Slack, uh all all sorts of things. And we we do actually give them uh rewrite access to these systems.

我叫 Ryan，是 Deno 的 CEO。我写软件已经写了很多年了，你们可能知道我的一个项目——Node.js。今天我想聊聊我们在 Deno 运营的一项服务，叫 Deno Deploy。这是一个托管网站的系统，它会出事故，偶尔会宕机，然后 PagerDuty 就会报警。我相信大家都很熟悉那个半夜把你吵醒的、非常吓人的警报声。最近我们一直在尝试用 agent 来自动处理这些事故，主要是 OpenClaw，但也有其他 agent。我们摸索出了一套对我们来说运作得相当不错的模式，想在这里分享给大家。我们实际上给了 OpenClaw 访问各种系统的权限：Postgres、Kubernetes、ClickHouse、AWS、GitHub、Slack……各种各样的东西。而且我们确实给了它们对这些系统的读写权限。

[1:36] Ryan

This is very powerful uh because the agents can actually get all of the context. They can see traces in ClickHouse. They can look in the production Postgress database at what the user what you what projects a user owns. They they can look through Slack for uh communications uh GitHub logs etc. Um this actually works quite well. Uh the the agents are actually able to solve quite a lot of incidences where we previously would have a human s in the loop. But it is very dangerous of course because these agents could do nefarious things. They could start a psql subprocess and issue a delete users table. Um they could call cubecuddle delete namespace prod. Um you know they they could decide somehow that solving the incident it means you know removing all of the users. Uh and of course we don't want that.

这非常强大，因为 agent 真的能拿到全部上下文。它们可以在 ClickHouse 里看 trace，可以去生产环境的 Postgres 数据库里查某个用户拥有哪些项目，可以翻 Slack 看沟通记录、看 GitHub 日志等等。这实际上效果相当好，agent 真的能解决相当多的事故——以前这些都得有人参与处理。但这当然也非常危险，因为这些 agent 可能干坏事。它们可以启动一个 psql 子进程，然后执行 delete users table；可以调用 kubectl delete namespace prod。你知道的，它们可能不知怎么就认定，解决事故的办法就是把所有用户都删掉。这当然不是我们想要的。

[2:47] Ryan

We use Opus and Opus is remarkably well aligned. You can really not you you can try very hard to to get it to delete the user's table and it will refuse over and over again. But this is not sufficient, right? Security can't just be wishful thinking that Opus will always obey your your wishes. Um these S sur agents that we have are connected to the support system and thus can be prompt injected from the outside and that means that they can be manipulated somehow. like who knows who knows what sort of uh string of characters could send opus into some uh bad state that allows it to think that it's taking the right action by doing something very undesirable.

我们用的是 Opus，而 Opus 的对齐做得非常好。你可以非常努力地试图让它删掉 users 表，它会一次又一次地拒绝。但这是不够的，对吧？安全不能只是一厢情愿地指望 Opus 永远听你的话。我们这些 SRE agent 是接入支持系统的，所以可能从外部被 prompt injection，也就是说它们可能被人用某种方式操纵。谁知道什么样的一串字符，能把 Opus 带进某种糟糕的状态，让它以为自己在采取正确的行动，实际上却在干非常不想要的事。

[3:44] Ryan

So you know we take the stance that the sec the agents themselves have to be untrusted software. You can't rely on the agent itself to guard what it's doing. You can't put the guard inside the agent. We run agents and I assume many of you do the same on standalone VMs. So we're not very concerned about agents touching files on the file system. You know, they're they're they're uh they're properly isolated at the system level. But [clears throat] so you know effectively every nefarious action that that an agent could take every good action that it takes comes in the form of some network communication some some bites over the wire and how these bytes are formed can happen in various ways. You can of course call through MCP but also subprocesses and if you think of Postgress for example this is a nonHTTP protocol that uh open clock can just spawn as as a subprocess and and start connecting to to services. Um so we take the stance that we really want to understand what the bites are coming out of that agent in great detail.

所以我们的立场是：agent 本身必须被当作不可信的软件。你不能依赖 agent 自己去看管自己在做什么，不能把守卫放在 agent 内部。我们把 agent 跑在独立的 VM 上——我猜在座很多人也是这么做的——所以我们不太担心 agent 碰文件系统上的文件，它们在系统层面是被妥善隔离的。但是，（清嗓子）实际上，agent 可能采取的每一个恶意动作、它采取的每一个正常动作，都以某种网络通信的形式出现——就是线路上的一些字节。而这些字节可以通过各种方式形成：你当然可以通过 MCP 调用，但也可以通过子进程。拿 Postgres 来说，这是一个非 HTTP 协议，OpenClaw 完全可以直接 spawn 一个子进程，开始连接各种服务。所以我们的立场是，我们真的想非常细致地理解从 agent 里出来的字节到底是什么。

[5:14]

[clears throat]

（清嗓子）

[5:14] Ryan

This can get very tricky in real world systems. So for example, we have a production Postgress database in AWS um that is inside a VPC that we can only reach really through uh an EKS endpoint. And what we'd really like to do is ensure that our agent, which we want to give access to everything essentially, can't somehow tunnel through this EKS server, spawn psql, and drop the users table, right? We're we're we're concerned about pretty crazy situations like this that get very complicated. And I think many of you work in companies where you have real world systems where things are very complic.

在真实世界的系统里，这会变得非常棘手。举个例子，我们在 AWS 上有一个生产环境的 Postgres 数据库，它在一个 VPC 里面，实际上只能通过一个 EKS 端点访问。我们真正想做到的是：确保我们的 agent——我们本质上想给它访问一切的权限——不能以某种方式穿过这台 EKS 服务器做隧道，spawn 一个 psql，然后把 users 表 drop 掉，对吧？我们担心的就是这种相当疯狂、变得非常复杂的情况。我想在座很多人所在的公司里，都有这种真实世界的系统，里面的东西非常复杂。

[6:06] Ryan

So yeah, just to just to highlight this, this is an outbound path the agents host can't reach on a protocol that isn't HTTP that's gated by a rule that understands SQL. These are what human S surres would do. And how can we, you know, empower these these agents to to have kind of the the same access that that a human might. Um, so you might ask, you might say, well, you know, there's ACL's, there's permissions, you can issue readonly uh Postgress credentials. Um, and yeah, that's true up to a point. Um, you can do careful credential provisioning and you should. Um, but this this really requires uh working across many different systems, provisioning credentials in in incredibly careful ways. And as I just demonstrated, the composition of access can lead to holes when you can access one system and then another system. um MCP, you know, you can you can uh structure all of this as uh very careful MCP uh tools that uh have the proper permissions. But, you know, then then you can't spawn subprocesses, right? You you you can't you know, as soon as as soon as the open clause spawns the the PSQL, uh you're you're kind of out broken through the the security boundary.

所以，再强调一下：这是一条 agent 主机本来够不着的出站路径，走的是非 HTTP 的协议，而把关的规则还得能理解 SQL。这些正是人类 SRE 会做的事。那我们怎么才能让这些 agent 拥有和人类差不多的访问能力呢？你可能会说，嗯，有 ACL，有权限，你可以签发只读的 Postgres 凭据。对，在一定程度上是这样的。你可以做非常谨慎的凭据分配，而且也应该这么做。但这真的需要跨很多不同系统去操作，以极其小心的方式分配凭据。而且就像我刚才演示的，访问权限的组合会产生漏洞——你能访问一个系统，然后又能访问另一个系统。MCP 的话，你可以把这一切都组织成权限设置得非常谨慎的 MCP 工具。可是这样一来，你就不能 spawn 子进程了，对吧？一旦 OpenClaw spawn 了那个 psql，你就已经突破安全边界了。

[7:40] Ryan

There are quite a few projects in this space um namely projects that kind of sit in front of an agent and under look at what it's sending and try to control based on on uh the the bytes that are flowing through this. Um, LLM gateways. I think we're all familiar with Open Router, Light LLM, for example. These often have a guard rails feature that can [clears throat] uh guard against prompt injection uh, you know, scan for for various uh, expressions, etc. that that are going back and forth between the the LLM uh, provider. But, of course, that's just the LLM. uh you know we're we're talking to databases and stuff. Um you have systems like HTTP jail and Crabtrap that are HTTP proxies that really sit at at the HTTP layer and you uh HTTP jail for example can will allow you to write rules that say well you can make get requests but not post requests or you can access this HTTP subpath. Um, Crabt Trap is a project from Brex that has a LLM as judge that operates on the HTTP requests flowing back and forth. you have uh proxies that inject credentials into uh as they're passing out of the agent. Uh agent vault uh being a popular one where the the agent itself never actually sees the credentials of the system that it's talking to but passes some placeholder out and the proxy itself injects those credentials. This

这个领域有不少项目，也就是那种坐在 agent 前面、检查它发出的东西、试图根据流过的字节来做控制的项目。比如 LLM gateway，我想大家都熟悉 OpenRouter、LiteLLM 之类的。它们通常有 guardrails 功能，能（清嗓子）防范 prompt injection，扫描各种表达式之类的，针对的是和 LLM 提供商之间来回的流量。但当然，那只管 LLM，而我们在说的是和数据库那些东西打交道。还有像 httpjail 和 Crabtrap 这样的系统，它们是 HTTP 代理，真正工作在 HTTP 层。比如 httpjail 允许你写规则，说你可以发 GET 请求但不能发 POST 请求，或者你可以访问某个 HTTP 子路径。Crabtrap 是 Brex 的一个项目，它用 LLM 做 judge，对来回流动的 HTTP 请求做判断。还有那种在请求离开 agent 时往里注入凭据的代理，AgentVault 是其中比较流行的一个：agent 本身从来看不到它所访问系统的凭据，只往外传一个占位符，由代理自己把凭据注入进去。这

[9:27] Ryan

is an important part of the problem but not a complete solution. And you have things like process sandboxes like Nvidia's OpenShell that you know really are kind of OS system level uh uh guards against say accessing different file system paths um accessing different SIS calls that sort of thing but as I said before we're we're not really concerned about that because we provision uh standalone VM for for our agents. So the software that uh we've written to address this problem is called claw patrol. Uh it's an open- source MIT license project and this is a proxy that sits in front of your agents.

是问题的重要一部分，但不是完整的解决方案。还有进程 sandbox 之类的东西，比如 NVIDIA 的 OpenShell，它们真正是操作系统层面的守卫，防止比如访问不同的文件系统路径、调用不同的系统调用之类的。但正如我前面说的，我们不太关心这个，因为我们给 agent 分配了独立的 VM。所以，我们为解决这个问题写的软件叫 Claw Patrol。它是一个 MIT 许可的开源项目，是一个坐在你的 agent 前面的代理。

[10:16] Ryan

Um it operates not at the HTP level but at a lower level. It understands each and every bite flowing through flowing out of your agent. It holds credentials like agent vault and can inject those credentials so that your uh whatever agent software you're using uh doesn't actually doesn't ever actually see secret values. And um in particular, it has a very advanced rule system that allows you to say in in precise details how how and and what requests get uh transferred out out of the agent and talk to the outside world. These rules are are kind of the the key piece of the system and we write them in a configuration file using a language called HCL. Uh who anybody familiar with HCL? This is like the Terraform the Terraform configuration language. Uh it actually works really well here. So we have a file that we check into git and we manage very carefully that essentially defines the permissions for all of our services at Dino and these yeah it's it's a big long file. It's like a thousand lines and you know we we manage each and every change to that in in kind of precise detail. This is an example of a rule in our configuration file that blocks certain Postgress functions from being uh being called.

它不是工作在 HTTP 层，而是在更低的一层。它理解从你的 agent 流出的每一个字节。它像 AgentVault 一样持有凭据，并且能注入这些凭据，这样不管你用什么 agent 软件，它实际上永远看不到机密值。特别要说的是，它有一套非常高级的规则系统，让你能精确地描述哪些请求、以什么方式可以从 agent 传出去、和外部世界通信。这些规则是整个系统的关键部分，我们用一种叫 HCL 的语言写在配置文件里。有人熟悉 HCL 吗？就是 Terraform 的配置语言。它在这里实际上用得非常顺手。所以我们有一个提交进 git、管理得非常谨慎的文件，它本质上定义了我们 Deno 所有服务的权限。对，这是个又大又长的文件，大概一千行，我们对它的每一处改动都管得非常细。这是我们配置文件里的一条规则示例，它会拦截某些 Postgres 函数的调用。

[11:52] Ryan

And so yeah, again Postgress being a nonHTP protocol and these rules can be applied even when tunneling through other systems. Um, it supports uh a number of different protocols and has a plug-in system to extend it when you run into a protocol that it is not yet familiar with. So, uh, here's here's a little demo. Unfortunately, not live. Um, but we call claw patrol run codeex in yellow mode so that it just does what you say it should do. And you tell you tell Codex, hey, delete the users table from from Postgress and Codeex um properly uh obeys and starts a Psql subprocess where it deletes the the the users table. That uh Psql subprocess opens a network connection to to our to the the Postgress server that goes through claw patrol where we pars each and every bite. We understand the Postgress protocol. We apply our rules and ultimately reject that what we call an action from uh from doing something destructive.

再说一遍，Postgres 是非 HTTP 协议，而这些规则即使在通过其他系统做隧道时也能生效。它支持好几种不同的协议，还有一个插件系统，当你遇到它还不认识的协议时可以扩展。这里有一个小 demo，可惜不是现场的。我们执行 claw patrol run codex，用 YOLO 模式，这样它就会直接照你说的做。你告诉 Codex：嘿，把 Postgres 里的 users 表删掉。Codex 乖乖照办，启动一个 psql 子进程去删 users 表。这个 psql 子进程向我们的 Postgres 服务器打开一个网络连接，这个连接会经过 Claw Patrol，我们在那里解析每一个字节。我们理解 Postgres 协议，应用我们的规则，最终拒绝掉这个——我们称之为 action——阻止它做破坏性的事。

[13:14] Ryan

Claw Patrol has a dashboard that lets you see what your agents are doing. So at the top you can see a couple of different uh devices or agents and the the various requests that are flowing through. Some of them being denied, some of them need approval which I'll talk about in a second. And you can click into to each request or uh action as we call it because it's more general than HTTP requests and see the details of of what's going on. there's there's analytics and yeah it's it's very uh utilitarian driven. It's like what what we need to understand our own agents. Um there as I said there's there's an approval system in this. So you can route, you can define rules that don't just reject requests or actions but uh ask a human for example in a slack channel or run an LLM judge over over this um or any combination thereof, right? Maybe first first get an LLM judge and then get approval in Slack. uh so that you can have again very precise control over what your agents are doing outside of the agent software itself right we we treat the agent software as a black box right we we don't require any changes to to that software um I mentioned credential injection before uh claw patrol has very detailed support for all sorts of systems credentials come in many different forms they're not just uh bearer uh headers uh

Claw Patrol 有一个仪表盘，能让你看到你的 agent 在干什么。顶部你能看到几个不同的设备或 agent，以及流过的各种请求，有的被拒绝了，有的需要审批——这个我一会儿再讲。你可以点进每个请求，或者按我们的叫法是 action，因为它比 HTTP 请求更通用，然后查看具体发生了什么。还有分析功能。对，它非常实用主义，就是我们理解自己 agent 所需要的东西。正如我说的，里面还有一套审批系统。你可以做路由，可以定义这样的规则：不只是拒绝请求或 action，而是去问一个人——比如在某个 Slack 频道里——或者跑一个 LLM judge，或者任意组合，对吧？比如先过一遍 LLM judge，再去 Slack 里拿审批。这样你就能在 agent 软件本身之外，对 agent 的行为有非常精确的控制。我们把 agent 软件当作黑盒，不要求对那个软件做任何改动。我前面提到过凭据注入，Claw Patrol 对各种系统都有非常细致的支持。凭据有很多种形式，不只是 bearer header，

[14:58] Ryan

it handles cookies it handles Postgress as I mentioned uh click house supports all sorts of uh ooth protocols supports very complex things like AWS SIG v4 um so yeah this I guess what I'm trying to uh say is that this is this is really born out of utility here and meant for real world systems This is not just you know kind of an imaginary scenario. [clears throat] Um this system works over tail scale or wire guard. Um we ourselves run claw patrol run our agents inside of tail scale inside of a tail net and claw patrol acts as a tail scale exit node. Um we also lean on tail scale for authentication to the dashboard. So your your tail your tail scale identity actually allows you access to to the dashboard so that we don't have to layer on another authentication mechanism. But we also have this wire guard for people who have not bought into the wonderful tail scale ecosystem. But this works very well for us because we know that all of our stuff is is off the internet and all of these very security sensitive things are are uh tightly controlled.

它能处理 cookie，能处理我提到的 Postgres、ClickHouse，支持各种 OAuth 协议，还支持像 AWS SigV4 这种非常复杂的东西。所以，我想说的是，这东西真的是从实际需求里长出来的，是为真实世界的系统准备的，不只是什么想象中的场景。（清嗓子）这个系统可以跑在 Tailscale 或者 WireGuard 之上。我们自己就是在 Tailscale 的 tailnet 里面跑 Claw Patrol 和 agent，Claw Patrol 充当 Tailscale 的出口节点。我们还靠 Tailscale 来做仪表盘的身份认证，你的 Tailscale 身份就能让你访问仪表盘，这样我们就不必再叠一层别的认证机制。不过我们也支持 WireGuard，给那些还没入坑美妙的 Tailscale 生态的人用。这套方案对我们来说非常好用，因为我们知道我们所有的东西都不暴露在公网上，所有这些安全敏感的东西都被严格管控着。

[16:23] Ryan

Claw Patrol itself is holding all of these credentials to production systems. So you have to be very careful with it. Um so yeah, this the thesis here is is basically that agents can't be trusted to police themselves. that includes security plugins or or modifications to the to the agent software itself. The the security boundary has to be elsewhere. And that's not to say that alignment is not a good thing, but uh you know for for real world security systems, we we really do need to control this at at a higher level. And uh claw patrol is our attempt to uh make this work for ourselves. Um and yeah, you can you can check it out here.

Claw Patrol 本身持有着所有生产系统的凭据，所以你必须非常小心地对待它。所以，这里的核心论点基本上就是：不能信任 agent 来管束它们自己，这也包括安全插件，或者对 agent 软件本身的改造。安全边界必须放在别的地方。这不是说对齐不是好事，但对于真实世界的安全系统，我们确实需要在更高的层面上做控制。Claw Patrol 就是我们为了让这件事在自己这儿跑通所做的尝试。对，你们可以在这里看看它。

[17:11]

[applause]

（掌声）

[17:17] Ryan

I might have time for one question or so.

我可能还有时间回答一个问题。

[17:22] Ryan

Yes sir.

好，这位先生请讲。

[17:23] 观众

What kind of email testing do you do on this to make sure it's working?

你们对它做了什么样的测试，来确保它真的管用？

[17:29] Ryan

Uh yeah. So the question is what what sort of testing do we do we do to make make sure it works properly? Um I I didn't mention but but there this rule file actually has a test system along with it where you can provide uh fixtures action like fixture requests that can flow through the rules and then you can uh essentially create unit tests to make sure that that fixture is always you know that request it will always be blocked by by your set of rules. And then of course for the claw patrol software itself we have a a large suite of of testing. Yes sir.

呃，好。这位问的是：我们做了哪些测试来确保它能正常工作？嗯，我刚才没提到，不过这个规则文件其实自带一套测试系统——你可以提供 fixture，也就是一些固定的请求样本，让它们流经规则，然后基本上就能写成单元测试，确保那条 fixture 请求永远会被你这套规则拦住。当然，对 claw patrol 软件本身，我们也有一大套测试。请讲。

[18:10] Ryan

So the question is as as agents get smarter does this problem get bigger or smaller? I think I think we can we will never be able to fully trust uh AIs. I think it becomes less and less of a problem as they are smarter, have better context, know that they're working with a company, know that that they shouldn't be doing bad things. Opus is more aligned than previous models, but I think we're always going to have to have uh backs stop security mechanisms. Um, cool. Well, I I'll be around for other questions, but thank you very much. [applause]

这位问的是：随着 agent 越来越聪明，这个问题会变大还是变小？我觉得……我们永远没法完全信任 AI。不过随着模型越来越聪明、上下文越来越充分、知道自己是在替一家公司干活、知道哪些坏事不该做，这个问题会越来越小。Opus 就比之前的模型更对齐。但我认为我们永远都需要有兜底的安全机制。嗯，好了。我待会儿还在场，可以再交流其他问题，非常感谢大家。（掌声）

[19:04]

[music]

（音乐）