AI Agent 的“杀毒软件”：究竟什么才能真正保护你的机器

AI 编程 Agent（代码助手）以你的用户权限运行。它可以读取你的 .env 文件、SSH 密钥和终端历史记录，并执行命令。这一切无需安装任何“恶意软件”就可能出问题。本文将解释为什么传统的特征码杀毒软件无法防范这种风险、什么手段才有效，以及如何在三分钟内完成本机自检。

不要轻信我们。花一分钟亲自检查。

• 在你的机器上离线运行。 守卫无需网络、无需账号即可运行检查。安装完成后断开 Wi-Fi 仍能正常工作。它绝不会主动发起网络请求。仅有三项操作会访问网络（获取知识包、查看商店目录、可选的诱饵监控），且每一项都必须在你明确同意其预先展示的完整命令后才会执行。
• 无任何隐藏代码。 零依赖项，无安装脚本（install scripts）。安装时不会在后台静默执行任何操作。
• 开源且完全可读。 采用 MIT 许可证，纯 JavaScript 编写。你可以直接下载 npm 发布的安装包并审查全部源代码。
• 唯一的出网途径是 curl，且一目了然。 Dante 本身没有任何网络代码（无内置 HTTP 库）；若要访问互联网，它会启动 curl，下方的自检会列出所有可能调用的位置。它唯一自行打开的直接连接，是针对你指定的服务器询问“22 端口是否有响应”。
• 可安全地从外部扩展。 新知识以已签名的纯数据包形式提供（仅包含规则，绝不包含代码），并通过程序内置的公钥进行校验。下载好的数据包可通过 pack <file> 在完全断网状态下安装。

一分钟自检（终端环境，需安装 Node.js）。复制每行命令并按回车：

npm view dante-watch dependencies scripts

输出应为 dependencies = {} 且没有脚本。

npm pack dante-watch && tar -xzf dante-watch-*.tgz

下载对应的安装包并解压。整个程序代码均位于 package/src 目录下：你可以直接审查。

grep -rn 'execProgram.*"curl"' package/src

列出所有可能访问互联网的位置（撰写本文时仅有 6 处）。了解更多：哪些操作会接触网络。

   YOU                         YOUR AI AGENT                 ANYONE WHO TALKS TO IT
  ┌─────┐   same rights    ┌────────────────┐   instructions   ┌────────────┐
  │ ◉ ◉ │ ───────────────▶ │  reads  .env   │ ◀─────────────── │  web page  │
  │  ▽  │                  │  reads  ~/.ssh │                  │  issue     │
  └─────┘                  │  runs  commands│                  │  README    │
                           └───────┬────────┘                  └────────────┘
                                   │
                          what it can reach is
                          what a hijack can take

风险不在于病毒，而在于访问权限的触达范围（reach）。

核心要点（TL;DR）

• 它是什么： Dante 是一个面向个人电脑和服务器的免费防护守卫。它能找出 AI Agent 或攻击者最先盯上的目标：暴露的密钥、开放的端口和高危配置。
• 为什么不用传统杀毒软件： Agent 是以你自身权限运行的合法软件，根本没有“病毒”可抓，真正需要做的是限制其触达范围。
• 如何运行： 执行 npx dante-watch，然后输入“check my computer”（检查我的电脑）。它全程仅执行只读操作，且每项判决都会附带证据行。
• 支持平台： Mac、Windows、Linux 以及通过 SSH 连接的服务器。除非你明确批准它提前展示的命令，否则绝无数据离开你的机器。
• 诱饵监控（Bait watch）： Dante 能布设蜜罐（Canary tokens），即伪造的凭据，其外观与窃贼或失控 Agent 最先抓取的内容一模一样。一旦有人触碰使用，它会立刻发出告警，数秒内将邮件发送给你。首月免费，后续每月 1.99 欧元；该费用用于资助背后的安全研究。我们正在持续完善此功能。
• 费用： 审计守卫本身完全免费。如果需要更强能力，可选购扩展知识包和诱饵监控服务。

为什么传统杀毒软件用错了地方

传统杀毒软件的工作原理是将文件和行为与已知恶意代码特征进行比对。当机器上运行了外来恶意程序时这很奏效。但面对 AI Agent 时情况完全不同：程序本身是合法的、有合法签名的、是你主动安装的，并且它是以你自身的用户权限在执行操作。风险并不在于病毒，而在于该 Agent 能够触达哪些数据，以及外部输入能诱使它执行什么操作。

这正是该产品背后的核心逻辑，而非某种统计上的检出率指标：如果最危险的是明文暴露在可读文件中的密钥，那么真正有价值的检查是“哪里存放了哪些机密凭据，以及谁有权读取它们”，而不是“这个二进制文件是否命中病毒库签名”。

这绝非纸上谈兵。2025 年 8 月，针对 Nx 构建工具的 s1ngularity 攻击 就植入了恶意代码，专门扫描系统中已安装的 AI 命令行助手，诱导其搜索受害者文件系统中的凭证、SSH 密钥和加密货币钱包。数周后，具备自传播能力的 Shai-Hulud npm 蠕虫 也采用了类似手法搜寻 npm 发布令牌。这两起攻击之所以得逞，全因这些敏感凭据存放在任何当前用户进程皆可随意读取的位置。

.env、数据库与 API 密钥、~/.ssh/id_ed25519、~/.aws/credentials、终端历史记录……

text agent ❯ cat .env agent ❯ ls ~/.ssh agent ❯ history agent ❯ ▌ grrr… 让我进去

具有与你完全相同的权限 · 无需安装任何恶意软件就会导致灾难。你的 Agent 想要访问权限。它本身就拥有你的全部权限，因此它能接触到什么是关键所在。

Dante 是什么

Dante 是一个免费且开源的命令行守卫工具，面向你拥有的机器：包括 Mac、Linux 或 Windows 电脑，以及可通过 SSH 访问的服务器。你可以使用日常德语、英语或西班牙语与它交互。它只读取、只解释，未经你的明确许可绝不改动任何内容。

• 每项结论都带有其来源的真实证据行。 如果 Dante 无法读取证据，给出的判决将是 unknown（未知）。它绝不会基于假设得出 safe（安全）的结论。
• 默认完全静默。 无遥测、无后台更新检查、无需注册账号。免费功能完全离线运行。
• 零依赖。 一个轻量且代码完全可读的 Node.js 程序。源代码已公开。

______终端 — dante-watch

text user ❯ check my computer

SAFE Openly readable secrets in the web directory what: No openly readable .env/.sql/.git files in the web root. proof: • Web root searched, nothing readable found ↳ dante:find-files /var/www (.env, *.sql, …) → (no matches in: /var/www)

UNKNOWN SSH: root login and password login what: No SSH service listens on port 22 here; I do not know whether the settings matter. proof: • PermitRootLogin = (not set) ↳ /etc/ssh/sshd_config → PermitRootLogin default

每项判决都带有其来源的实际配置行。如果 Dante 无法读取证明，它会显示 UNKNOWN，绝不妄言 SAFE。

检查内容

• 散落各处的机密凭据：扫描项目文件、.env 文件和 Git 提交历史中的 API 密钥、Token 以及私钥，基于涵盖 1,111 种凭据格式的特征库进行匹配。它仅展示文件名、行号及类型——绝不打印出具体密钥值。
• 你的服务器：SSH 配置、Web 目录中对所有人可写的文件、基于版本的已知 PHP 漏洞、Web Shell 迹象。
• AI Agent 配置：MCP 服务器条目与 Agent 配置文件（需配合可选的 Hugging Face 分析包），全程不泄露任何密钥。
• 诱饵文件（即“Wachschutz”蜜罐）：伪造凭据，一旦有人调用，会立即向你发送邮件告警。
• Windows 系统：任何人皆可覆写的系统服务、未加引号的服务路径（Unquoted Service Paths）、可写的 PATH 目录、AlwaysInstallElevated 配置、存储的自动登录密码。

它真的好用吗？一个坦诚的回答

Dante 目前还很年轻。它是一个守卫者（watchman），而非实时防护引擎：它仅在你发出请求或按你约定的计划任务执行检查，不会在后台实时扫描运行中的进程以查杀恶意程序。它擅长的是枯燥却高价值的工作：找出攻击者或被劫持的 Agent 最先利用的敏感凭据与配置漏洞，并且绝不过度承诺它无法证实的事项。其自然语言交互层基于约 25.9 万条已标注句子训练，在遇到不确定的内容时会如实回答“我不知道”，而非凭空胡猜。

四步推进，步步清晰

text STEP 1 LOOK ████████████████████ 免费 · 3分钟 · 仅只读 STEP 2 DIG DEEP ██████████████░░░░░░ 扫描项目文件夹中的凭据 STEP 3 BAIT █████████░░░░░░░░░░░ 布设触发即告警的伪造密钥 STEP 4 STAY SHARP ████░░░░░░░░░░░░░░░░ 获取抵御新型攻击的最新知识包

大多数人在完成第 1 步后即可大幅提升安全水位。每一步都需要你的单独确认。

你无需一次性决定所有操作。从第 1 步开始即可。Dante 在执行后续任何操作前都会先征求你的同意，且每次询问都会先完整展示将要执行的命令。

三分钟快速上手

安装 Node.js（访问 nodejs.org，仅需安装一次），打开终端，粘贴以下命令：

npx dante-watch

______终端 — Mac

text you@MacBook ~ % npx dante-watch

I am Dante. I walk through hell and bring back the map.

● awake · I watch over localhost.

user ❯ check my computer

Mac：Terminal

______PowerShell — Windows

text PS C:\Users\you> npx dante-watch

I am Dante. I walk through hell and bring back the map.

● awake · I watch over localhost.

user ❯ check my computer

Windows：PowerShell

同一套程序、相同指令，跨全平台运行。如果不确定终端在哪里，安装指南页面提供了针对 Mac、Windows 和 Linux 的逐步说明。

有关各系统的详细说明、免费与付费模块及各项费用，请参阅安装指南页面。

最好的检查时机，永远是在事故发生之前。

在你关闭此标签页之前

坦白说，没有人早上一醒来就想着去审查笔记本电脑的安全。这很无聊，感觉就像家庭作业，而且在出事之前一切看起来都毫无破绽。

所以不妨做个权衡：这只需要三分钟。完全只读。零花费。如果什么都没扫出来，你不过花了三分钟，至少确认了机器目前安然无恙；但如果它真的扫出了遗落的密钥，你就赶在别人发现它之前拔除了隐患。

无论如何，你的 Agent 已经掌握了进出你房间的钥匙。唯一的区别在于，你是否清楚它手里到底拿了哪些钥匙。

npx dante-watch

看一眼没有任何损失。 Dante 仅执行只读检查。在作出任何更改前必先征询同意，并提前展示命令。无需账号。随时删除 ~/.dante 文件夹即可彻底卸载。

常见问题

AI Agent 需要杀毒软件吗？

它们确实需要防护，但不是那种基于病毒特征码匹配的传统杀毒软件。Agent 是以你的权限运行的合法软件。真正关键的是它能访问哪些机密数据与服务器，以及外界是否能诱导它执行危险指令。排查凭据存放位置、SSH 配置状态以及 Agent 规则配置，才能真正覆盖实际的暴露风险。

Dante 是杀毒软件吗？

不是。Dante 是为你名下机器提供审计的守卫。它不执行实时恶意软件查杀。它的作用是揪出暴露的凭据、危险配置与已知漏洞，并为每一项结果展示对应的证据行。

Dante 会把我的数据发送到外部吗？

不会。默认情况下它不发送任何数据。只有三项操作会调用网络（更新知识包、查询目录以及可选的诱饵监控），并且每项操作都必须在你明确同意 Dante 提前打印的命令后才会执行。

它是免费的吗？

是的。免费功能完整且可完全离线运行。扩展知识包和诱饵监控服务为可选项目；具体费用详见安装页面。

Antivirus for AI agents: what actually protects your machine

An AI coding agent runs with your rights. It can read your .env, your SSH keys and your shell history, and run commands. Nothing "malicious" has to be installed for that to go wrong. This page explains why signature antivirus does not cover that, what does, and how to check your own machine in three minutes.

DO NOT TRUST US. CHECK IT IN ONE MINUTE.

• Runs on your machine, offline. The watchman needs no internet and no account to check. Once it is installed, turn Wi-Fi off and run it: it still works. He makes no network call on his own. Only three things can reach out (fetch a knowledge pack, look at the shop catalog, the optional bait watch), and each one only after you say yes to the exact command he shows first.
• Nothing hidden in the package. No dependencies, no install scripts. Nothing runs when you install it.
• Open and readable. MIT-licensed, plain JavaScript. You can download exactly what npm serves and read the whole program.
• The only way out is curl, and you can count it. Dante has no web code of his own (no HTTP library); to reach the internet he starts curl, and the check below lists every place where that can happen. The only direct connection he opens himself is the question "does port 22 answer?" on a server you named.
• Extendable from outside, safely. New knowledge arrives as signed data packs (rules, never code), checked against a key built into the program. A downloaded pack installs with pack <file>, without any network.

The one-minute check (terminal, Node.js installed). Copy each line, press Enter:

npm view dante-watch dependencies scriptsCopy

Prints dependencies = {} and no scripts.

npm pack dante-watch && tar -xzf dante-watch-*.tgzCopy

Downloads the exact package and unpacks it. The whole program is the folder package/src: read it.

grep -rn 'execProgram.*"curl"' package/srcCopy

Lists every place that can reach the internet (six at the time of writing). More: what touches the network.

   YOU                         YOUR AI AGENT                 ANYONE WHO TALKS TO IT
  ┌─────┐   same rights    ┌────────────────┐   instructions   ┌────────────┐
  │ ◉ ◉ │ ───────────────▶ │  reads  .env   │ ◀─────────────── │  web page  │
  │  ▽  │                  │  reads  ~/.ssh │                  │  issue     │
  └─────┘                  │  runs  commands│                  │  README    │
                           └───────┬────────┘                  └────────────┘
                                   │
                          what it can reach is
                          what a hijack can take

The risk is not a virus. It is the reach.

TL;DR

• What: Dante is a free watchman for your own computer and servers. It finds the things an AI agent or a thief would grab first: loose keys, open doors, risky settings.
• Why not antivirus: an agent is legitimate software with your rights. There is no virus to catch. There is reach to limit.
• How: npx dante-watch, then say "check my computer". It only reads, and every verdict shows its proof line.
• Where: Mac, Windows, Linux, and servers you reach by SSH. Nothing leaves your machine unless you say yes to a command he shows first.
• Bait watch: Dante lays honeypots, fake keys that look exactly like what a thief or a rogue agent grabs first. If someone uses one, it calls us and you get a mail within seconds. First month free, then 1.99 EUR a month; that money pays for the research behind it. We are building this out.
• Cost: the watchman itself is free. Optional knowledge packs and the bait watch if you want more.

Why a normal antivirus is the wrong tool for this

A classic antivirus compares files and behaviour against known malware. That works when something foreign runs on the machine. With an AI agent the situation is different: the program is legitimate, it is signed, it was installed on purpose, and it acts with your user rights. The risk is not a virus. The risk is what the agent can reach and what can talk it into using it.

That is the reasoning behind the product, not a measured detection statistic: if the dangerous thing is a secret lying in a readable file, the useful check is "which secrets lie where, and who can read them", not "does this binary match a signature".

This is not theory. In August 2025 the s1ngularity attack on the Nx build tool shipped malware that looked for installed AI command-line assistants and told them to search the victim's file system for credentials, SSH keys and wallets. Weeks later the self-spreading Shai-Hulud npm worm hunted for publishing tokens. Both worked because the secrets were sitting where any process of the user could read them.

.envdb + API keys ~/.ssh/id_ed25519 ~/.aws/credentials shell history agent ❯ cat .envagent ❯ ls ~/.sshagent ❯ historyagent ❯ ▌ grrr… let me in same rights as you · nothing has to be installed for this to go wrong Your agent wants in. It already has your rights, so what it can reach is what matters.

What Dante is

Dante is a free, open command-line watchman for machines you own: your Mac, Linux or Windows computer, and servers you can reach by SSH. You talk to it in plain German, English or Spanish. It reads, it explains, and it changes nothing without a clear yes.

• Every verdict carries the real line it came from. If Dante cannot read the proof, the verdict is unknown. It never says safe on an assumption.
• Silent by default. No telemetry, no background update check, no account. The free state runs fully offline.
• Zero dependencies. One small Node.js program you can read. The source is public.

______Terminal — dante-watch

 user ❯ check my computer

  SAFE   Openly readable secrets in the web directory
  what: No openly readable .env/.sql/.git files in the web root.
  proof:
    • Web root searched, nothing readable found
      ↳ dante:find-files /var/www (.env, *.sql, …)  →  (no matches in: /var/www)

  UNKNOWN   SSH: root login and password login
  what: No SSH service listens on port 22 here; I do not know whether the settings matter.
  proof:
    • PermitRootLogin = (not set)
      ↳ /etc/ssh/sshd_config  →  PermitRootLogin default

Every verdict carries the line it came from. If Dante cannot read the proof, it says UNKNOWN, never SAFE.

What it checks

• Secrets lying around: API keys, tokens and private keys in project files, .env files and Git history, matched against a library of 1,111 secret formats. It shows file, line and kind - never the value.
• Your servers: SSH settings, world-writable files in web folders, known PHP vulnerabilities by version, signs of web shells.
• AI agent configuration: MCP server entries and agent settings (with the optional Hugging Face analysis pack), reported without ever printing a key.
• Bait files (the "Wachschutz"): fake credentials that mail you the moment someone uses them.
• Windows: services anyone can overwrite, unquoted service paths, writable PATH folders, AlwaysInstallElevated, stored autologon passwords.

Is it any good? An honest answer

Dante is young. It is a watchman, not a real-time engine: it looks when you ask or on the schedule you agreed to, and it does not scan running processes for malware. What it does well is the boring, high-value part: finding the secrets and settings an attacker or a hijacked agent would use first, and refusing to claim more than it can prove. Its language layer (what you type) is trained on about 259,000 labelled sentences and answers "I don't know" instead of guessing when unsure.

Four steps, each one small

  STEP 1  LOOK        ████████████████████  free · 3 minutes · reads only
  STEP 2  DIG DEEP    ██████████████░░░░░░  secrets in your project folders
  STEP 3  BAIT        █████████░░░░░░░░░░░  a fake key that rings when it is used
  STEP 4  STAY SHARP  ████░░░░░░░░░░░░░░░░  fresh knowledge packs for new attacks

Most people stop after step 1 and are already better off. Each step is its own yes.

You never have to decide everything now. Start with step 1. Dante asks before every next thing, and every question shows the exact command first.

Start in three minutes

Install Node.js (nodejs.org, once), open a terminal, paste one line:

npx dante-watchCopy

______Terminal — Mac

 you@MacBook ~ % npx dante-watch

  I am Dante. I walk through hell and bring back the map.

  ● awake · I watch over localhost.

user ❯ check my computer

Mac: Terminal

______PowerShell — Windows

 PS C:\Users\you> npx dante-watch

  I am Dante. I walk through hell and bring back the map.

  ● awake · I watch over localhost.

user ❯ check my computer

Windows: PowerShell

Same program, same words, on every system. Not sure where your terminal is? The install page shows it for Mac, Windows and Linux, step by step.

Details for every system, the free and paid parts and what each costs are on the install page.

The best time to check is before something happens.

Before you close this tab

Look, nobody wakes up wanting to audit their laptop. It is boring, it feels like homework, and it always looks fine until the day it does not.

So here is the deal. It takes three minutes. It only reads. It costs nothing. If it finds nothing, you wasted three minutes and you can say you checked. If it finds a key lying around, you found it before somebody else did.

Your agent has the keys to your house either way. The only question is whether you know which keys.

npx dante-watchCopy

Nothing to lose by looking. Dante only reads. It asks before every change and shows the command first. No account. Delete the folder ~/.dante and it is gone.

Questions people ask

Do AI agents need antivirus?

They need protection, but not the kind that matches malware signatures. An agent is legitimate software running with your rights. What matters is which secrets and servers it can reach and whether anything can instruct it. Checking where secrets lie, how SSH is set and what the agent configuration allows covers the real exposure.

Is Dante an antivirus?

No. Dante is a watchman for machines you own. It does not scan for malware in real time. It finds exposed secrets, risky settings and known vulnerabilities, and shows the proof line for each result.

Does Dante send my data anywhere?

No. By default it sends nothing. Only three actions use the network (update, the catalog, and the optional bait watch) and each starts only after you answer yes to the command Dante prints first.

Is it free?

Yes. The free state is complete and works offline. Extra knowledge packs and the bait watch are optional; prices are on the install page.