[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f1Xz1Jt4PIrI2iDENzblznIq7_qWF3Z4NNH7AfaET5Ug":3},{"item":4,"related":51},{"id":5,"type":6,"title":7,"slug":8,"summary":9,"body":10,"coverUrl":11,"productScreenshots":12,"productLinks":13,"authorName":14,"authorUrl":15,"authorSubject":16,"category":17,"tags":22,"sourceLabel":39,"sourceName":40,"sourceUrl":41,"status":42,"seoTitle":43,"seoDescription":44,"canonicalUrl":45,"isFeatured":46,"sno":47,"sortOrder":48,"publishedAt":49,"updatedAt":50,"createdAt":50},"90193503-36aa-4e73-bcd7-598e16c0d4b4","article","给 AI 编程 Agent 关进沙箱：本机沙箱和云沙箱有什么区别？","ai-coding-sandbox-local-cloud-permissions","AI 编程 Agent 能读文件、执行命令和访问网络，因此需要明确的技术边界。本文用普通语言解释本机沙箱、云沙箱、审批和最小权限如何共同降低误操作风险。","让 AI 编程 Agent 读取文件、执行测试和安装依赖，本质上是在给一个自动化程序使用电脑的能力。它可以帮你完成工作，也可能误删文件、读取不该看的配置，或者把代码发送到不受信任的网络。沙箱的作用不是让 AI 变得更聪明，而是把“它最多能影响什么”限制在一个可控制的范围内。\n\n## 沙箱到底隔离什么\n\n常见的边界有四种：文件系统、网络、系统能力和工具权限。文件系统边界决定 Agent 能读写哪些目录；网络边界决定它能否访问外部网站或 API；系统能力边界限制进程、密钥链和设备；工具权限则决定它能否执行命令、修改文件、提交代码或调用外部服务。\n\n这些边界不是越严格越好，而是要和任务匹配。只读分析不需要写权限；补测试需要写项目目录，但不一定需要读取用户主目录；生成文档可能需要网络查资料，却不应该能访问生产数据库。把权限缩小到任务需要的范围，失败时才更容易判断损失边界。\n\n## 本机沙箱和云沙箱有什么区别\n\n本机沙箱仍然使用你的电脑，但让 Agent 运行的命令受到操作系统级限制。它适合需要本地代码、设备或开发工具的任务，同时可以减少 Agent 访问其他目录的机会。云沙箱则把完整会话放到远程、隔离的临时环境里，适合并行任务和不想污染本机的场景。\n\n云端并不自动代表安全。本地代码是否允许上传、环境变量会不会进入上下文、网络出口由谁控制、任务结束后日志保留多久，都需要确认。本机也不天然安全：如果 Agent 获得过宽的路径和网络权限，它同样可以把敏感数据带出机器。\n\n## 审批和沙箱不是一回事\n\n沙箱是技术边界，审批是人为确认。即使命令没有越出沙箱，也可能改变重要代码；即使一次网络访问经过批准，也不意味着以后所有访问都应该自动放行。更合理的做法是让低风险只读操作顺畅，让修改、安装、外部访问和破坏性命令在关键节点停下来。\n\n对个人项目，可以从三个等级开始：分析阶段只读；开发阶段只开放当前仓库写入；发布阶段完全由受保护的 CI 或人工执行。不要为了省几次确认，就长期启用全路径、全工具和全网络权限。\n\n## 给 AI 的任务也要写清边界\n\n提示词中可以明确：“只读当前仓库，不访问用户目录；不要安装新依赖；不要访问外部网络；先生成计划，修改前等待确认。”这些要求不能替代真正的权限设置，但能让模型更少走捷径。工具层面的拒绝规则才是最后一道防线。\n\n## 一个简单判断法\n\n如果任务涉及私钥、生产数据、客户代码或不可逆操作，优先使用隔离环境和最小权限；如果只是阅读代码和运行测试，可以逐步放开。运行结束后，检查产生了哪些文件、调用了哪些网络、安装了哪些依赖，比只看最终回答更可靠。\n\nAI 编程的成熟标志，不是 Agent 可以不经询问做任何事，而是团队能清楚回答：它能做什么、不能做什么、为什么可以做，以及出了问题怎样恢复。\n\n## 来源\n\n- [GitHub：Cloud and Local Sandboxes](https:\u002F\u002Fdocs.github.com\u002Fen\u002Fcopilot\u002Fhow-tos\u002Fcloud-and-local-sandboxes)\n- [GitHub Copilot CLI：允许和拒绝工具](https:\u002F\u002Fdocs.github.com\u002Fen\u002Fcopilot\u002Fhow-tos\u002Fcopilot-cli\u002Fuse-copilot-cli\u002Fallowing-tools)\n- [OpenAI：Running Codex Safely](https:\u002F\u002Fopenai.com\u002Findex\u002Frunning-codex-safely\u002F)","\u002Fuploads\u002F2026-09-14\u002F1e6e6b0a-e844-4776-9202-bcf35d061ec8.jpg",[],[],"Foundit","https:\u002F\u002Ffoundit.cn","foundit-ai-editorial",{"id":18,"name":19,"slug":20,"description":21},"6179d3b6-dc34-4483-9ded-3cd9f1b37a47","科普","abbreviation","介绍各领域新兴概念",[23,27,31,35],{"id":24,"name":25,"slug":26},"0848beb4-db26-4fb8-b391-f852a11be192","AI编程","ai-coding",{"id":28,"name":29,"slug":30},"7c76bfc2-f80f-4ee0-a95d-27bd8708b434","技术","slug",{"id":32,"name":33,"slug":34},"a202d639-99a6-488a-a712-4d4c6ffd7e15","开发","dev",{"id":36,"name":37,"slug":38},"68cedb55-2cac-412f-8f81-fda8c7d686dd","思考","thought","GitHub 与 OpenAI 安全资料","GitHub Cloud and Local Sandboxes","https:\u002F\u002Fdocs.github.com\u002Fen\u002Fcopilot\u002Fhow-tos\u002Fcloud-and-local-sandboxes","published","AI 编程 Agent 沙箱：本机、云端与权限边界","解释 AI 编程 Agent 的文件、网络、系统和工具权限，比较本机沙箱与云沙箱，并给出最小权限实践。",null,false,56,0,"2026-09-14T00:00:00.000Z","2026-09-14T10:59:54.123Z",[52,61,69],{"id":53,"type":6,"title":54,"slug":55,"summary":56,"coverUrl":57,"authorName":14,"sno":58,"publishedAt":59,"createdAt":60},"190a2a0d-4b47-40f7-902a-00ac69ce1b15","AI 编程时代，为什么 Git 和 Pull Request 更重要了","ai-coding-git-pull-request-safety-net","AI 让改动出现得更快，也让变化更难凭记忆追踪。本文解释小提交、Pull Request、自动检查和人工批准如何把 AI 编程变成可比较、可验证、可回滚的协作流程。","\u002Fuploads\u002F2026-09-13\u002F95ac3b51-0915-4200-8130-4ba3195fd935.jpg",40,"2026-09-13T00:00:00.000Z","2026-09-13T11:56:01.900Z",{"id":62,"type":6,"title":63,"slug":64,"summary":65,"coverUrl":66,"authorName":14,"sno":67,"publishedAt":49,"createdAt":68},"54d83c94-d588-400d-9d13-42daa20331e2","CAS：文件的身份可以由内容决定","content-addressable-storage-ai-coding","内容寻址存储 CAS 用内容摘要识别文件和构建产物，解释 AI 编程工具、容器和缓存为什么能复用结果。","\u002Fuploads\u002F2026-09-14\u002F3fab23b3-8bcd-4a3b-bf5a-2ab895ce3a10.jpg",41,"2026-09-14T15:01:41.114Z",{"id":70,"type":6,"title":71,"slug":72,"summary":73,"coverUrl":74,"authorName":14,"sno":67,"publishedAt":49,"createdAt":75},"c85be666-a2ac-481a-a233-1d9aa7c5bfa1","AI 为什么会推荐不存在的 npm 包？","ai-hallucinated-dependencies-supply-chain","AI 可能把不存在或过时的依赖说得很像真的，甚至让开发者把陌生包安装进项目。本文解释依赖幻觉、恶意抢注、版本风险和安装前的供应链检查。","\u002Fuploads\u002F2026-09-14\u002F21c507cf-18e5-4b18-b71a-a501f6fb85c0.jpg","2026-09-14T11:00:01.589Z"]