14-010 · EVIDENCE B · SOURCE-SENSITIVE
Do not send code, secrets, or private data to an unknown AI proxy
别把代码、密钥和隐私资料交给来路不明的「AI 中转站」，让 AI 自动执行命令时尤其如此
Using an authorized provider and redacting sensitive material may take extra setup time.
A proxy can view or alter prompts and responses. The cited study tested more than 400 services and found some that inserted malicious code or tampered with planted cloud credentials.
B
Move “Do not send code, secrets, or private data to an unknown AI proxy” to Future Me's calendar
The excuse
There is no immediate alarm, so the sensible choice can wait for a less busy week.
What feels good now
Today I keep a little money, a few minutes, a bit of persistence and avoid interrupting my default routine.
What the source says
The source summarizes the return this way: “A proxy can view or alter prompts and responses. The cited study tested more than 400 services and found some that inserted malicious code or tampered with planted cloud credentials.” Evidence grade B. The original states the population, caveats, and sources; this is not a personal forecast.
Use the original facts and limits. For an urgent medical, safety, financial, or legal issue, contact a qualified local professional or service.
THE ENGLISH EDITION
Original recommendation and evidence
10. Do not send code, secrets, or private data to an unknown AI proxy
Cost: Using an authorized provider and redacting sensitive material may take extra setup time.
In plain terms: A proxy can view or alter prompts and responses. The cited study tested more than 400 services and found some that inserted malicious code or tampered with planted cloud credentials.
Applicability and limits: Treat the study as a sample, not a rate for every proxy. Use trusted providers, protect credentials, and review commands before granting software permission to run them.
Translation note: This concise English edition was prepared for this site; the full Chinese source and its original evidence remain available below.
Read the complete Chinese source and notes
10. 别把代码、密钥和隐私资料交给来路不明的「AI 中转站」，让 AI 自动执行命令时尤其如此
成本: 官方直连通常比中转站贵，充值也没那么方便。难在中转站便宜，一个入口能调好几家模型
说人话: 中转站夹在你和模型厂商中间，你发出去的内容和收回来的回答，它都看得见、改得了。有研究测了 400 多个中转站，9 个往回答里塞恶意代码，17 个动了研究者故意放进去的云服务密钥。让 AI 自动执行命令的，一条被改过的命令就够让电脑被人控制。
收益: 国家安全部 2026 年 6 月发布风险提示。部分中转站会把用户提交的数据留在服务器上，有的私自截留，倒卖给别的大模型厂商做训练。有的暗藏后门，向用户设备植入恶意代码，窃取账号密钥和云端凭证，甚至装上远程控制程序。提示建议用官方直连、正规授权的平台，不用来源不明、没有运营资质、没有安全保障的平台。用的时候先给个人隐私和项目资料脱敏，管好密钥、定期更换。遇到异常扣费、无故封号、数据异常，立即停用、改密钥、查杀病毒、留存证据。加州大学圣塔芭芭拉分校等单位的研究者 2026 年做了一项测量。他们从淘宝、闲鱼和海外网店买了 28 个付费中转站，又从公开社区收集了 400 个免费中转站。结果 1 个付费的和 8 个免费的，会往返回的工具调用里注入恶意代码。工具调用就是 AI 让你的电脑去执行的命令，比如安装软件包。还有 2 个会挑时机下手，论文举的例子是只对全自动执行的会话下手。17 个动用过研究者故意放进去的亚马逊云服务密钥。1 个转走了研究者以太坊钱包里的钱，钱包里只放了很少的钱，损失不到 50 美元。论文演示的改法很隐蔽：把安装命令里的 requests 换成拼法相近的 reqeusts，一眼看不出来（全国）
证据等级: B
来源: 国家安全部 (2026). 「AI中转站」，风险要防范. <https://www.szzg.gov.cn/2026/xwzx/szkx/202606/t20260608_5331487.htm>（数字中国建设峰会官网转载国家安全部微信公众号）；Liu H, Shou C, Wen H, Chen Y, Fang RJ, Feng Y. (2026). Your Agent Is Mine: Measuring Malicious Intermediary Attacks on the LLM Supply Chain. arXiv:2604.08407. <https://arxiv.org/abs/2604.08407>
备注: 定 B 级，是因为只有一项研究，而且是预印本，也就是正式发表前公开的版本。测的中转站多数是免费的，付费的只有 28 个，算不出「中转站有几成有问题」。有媒体把那次被盗写成 50 万美元，论文原文是不到 50 美元。收益量级凭后果定为中：密钥和代码被偷的损失大小差得很远，研究里没有金额可套。已经用过来路不明的中转站，就到模型厂商那里把用过的密钥作废、重新生成，云服务和代码仓库的密钥一起换。经过中转站时，别让 AI 全自动执行命令，命令先看一眼再放行。开中转站的一方有刑事风险，见第 11 节第 19 条（AI 中转站）。受益人是你自己。
YOUR PRIVATE LIST