- かつ、アプリに認証がなく、同一ネットワークからのリクエストは信頼できると想定している

## 攻撃例 { #example-attack }

ローカルで AI エージェントを実行できる仕組みを構築したとします。

それは次の API を提供します。

```
http://localhost:8000/v1/agents/multivac
```

フロントエンドもあります。

```
http://localhost:8000
```

/// tip | 豆知識

両方とも同じホストであることに注意してください。

///

そのフロントエンドを使って、AI エージェントに自分の代わりに作業をさせられます。

# assign this replication policy to repluser
mc admin policy attach dest replpolicy --user=repluser

# configure replication config to remote bucket at http://localhost:9000
mc replicate add source/bucket --priority 1 --remote-bucket http://repluser:repluser123@localhost:9000/bucket \

    description: str | None = None
    price: float
    tax: float | None = None


@app.put("/items/{item_id}")
async def update_item(
    *,
    item_id: int = Path(title="The ID of the item to get", ge=0, le=1000),
    q: str | None = None,
    item: Item | None = None,
):
    results = {"item_id": item_id}
    if q:
        results.update({"q": q})
    if item:
        results.update({"item": item})

     * This is a required field for identifying which role to update.
     */
    @Required
    @Size(max = 1000)
    public String id;

    /**
     * The username of the user who last updated this role.
     * Used for audit trail purposes to track who made changes.
     */
    @Size(max = 1000)
    public String updatedBy;

    /**
     * The timestamp when this role was last updated.

     * This is a required field for identifying which label type to update.
     */
    @Required
    @Size(max = 1000)
    public String id;

    /**
     * The username of the user who last updated this label type.
     * Used for audit trail purposes to track who made changes.
     */
    @Size(max = 1000)
    public String updatedBy;

    /**
     * The timestamp when this label type was last updated.

     * This is a required field for identifying which token to update.
     */
    @Required
    @Size(max = 1000)
    public String id;

    /**
     * The username of the user who last updated this access token.
     * Used for audit trail purposes to track who made changes.
     */
    @Size(max = 1000)
    public String updatedBy;

    /**
     * The timestamp when this access token was last updated.

     * This is a required field for identifying which bad word to update.
     */
    @Required
    @Size(max = 1000)
    public String id;

    /**
     * The username of the user who last updated this bad word entry.
     * Used for audit trail purposes to track who made changes.
     */
    @Size(max = 1000)
    public String updatedBy;

    /**
     * The timestamp when this bad word entry was last updated.

     */
    @Required
    @Size(max = 1000)
    public String id;

    /**
     * The username of the user who last updated this boost document configuration.
     * Used for audit trail purposes to track who made changes.
     */
    @Size(max = 1000)
    public String updatedBy;

    /**

     * This is a required field for identifying which file config to update.
     */
    @Required
    @Size(max = 1000)
    public String id;

    /**
     * The username of the user who last updated this file configuration.
     * Used for audit trail purposes to track who made changes.
     */
    @Size(max = 1000)
    public String updatedBy;

    /**
     * The timestamp when this file configuration was last updated.

     */
    @Size(max = 1000)
    public String virtualHost;

    /**
     * The sort order for this related content (0-2147483647).
     */
    @Min(value = 0)
    @Max(value = 2147483647)
    @ValidateTypeFailure
    public Integer sortOrder;

    /**
     * The username who created this related content.
     */
    @Size(max = 1000)
    public String createdBy;

    /**