## Örnek Saldırı { #example-attack }

Yerelde çalışan bir AI agent’ı (yapay zeka ajanı) çalıştırmanın bir yolunu geliştirdiğinizi düşünün.

Bir API sunuyor:

```
http://localhost:8000/v1/agents/multivac
```

Ayrıca bir frontend var:

```
http://localhost:8000
```

/// tip | İpucu

İkisinin de host’u aynıdır.

///

	"github.com/minio/minio/internal/auth"
	levent "github.com/minio/minio/internal/config/lambda/event"
	"github.com/minio/minio/internal/hash/sha256"
	xhttp "github.com/minio/minio/internal/http"
	"github.com/minio/minio/internal/logger"
)

var getLambdaEventData = func(bucket, object string, cred auth.Credentials, r *http.Request) (levent.Event, error) {
	host := globalLocalNodeName
	secure := globalIsTLS
	if globalMinioEndpointURL != nil {

async def stream_chat(prompt: Prompt) -> AsyncIterable[ServerSentEvent]:
    words = prompt.text.split()
    for word in words:
        yield ServerSentEvent(data=word, event="token")

## Приклад атаки { #example-attack }

Уявіть, що ви створюєте спосіб запускати локального AI-агента.

Він надає API за адресою

```
http://localhost:8000/v1/agents/multivac
```

Є також фронтенд за адресою

```
http://localhost:8000
```

/// tip | Порада

Зауважте, що обидва мають один і той самий хост.

///

        // execute
        reader.readArtifactDescriptor(session, request);

        // verify
        verify(eventDispatcher).dispatch(event.capture());

        boolean missingArtifactDescriptor = false;

        for (RepositoryEvent evt : event.getAllValues()) {
            if (EventType.ARTIFACT_DESCRIPTOR_MISSING.equals(evt.getType())) {
                assertEquals(

   */
  @GwtIncompatible
  @J2ktIncompatible
  @CanIgnoreReturnValue
  @IgnoreJRERequirement // TODO: b/288085449 - Remove this once we use library-desugaring scents.
  @Beta // TODO: b/288085449 - Remove @Beta after we're sure that Java 8 APIs are safe for Android
  public FakeTicker advance(Duration duration) {
    return advance(duration.toNanos());
  }

  /**

    server.enqueue(
      MockResponse
        .Builder()
        .body(
          """
          |data: hey
          |
          |
          """.trimMargin(),
        ).setHeader("content-type", "text/event-stream")
        .build(),
    )
    val request = Request.Builder().url(server.url("/")).build()
    val response = client.newCall(request).execute()
    processResponse(response, listener)
    listener.assertOpen()

_setListeners=function(){var t=this;this.config.trigger.split(" ").forEach((function(e){if("click"===e)o.default(t.element).on(t.constructor.Event.CLICK,t.config.selector,(function(e){return t.toggle(e)}));else if("manual"!==e){var n=e===Ft?t.constructor.Event.MOUSEENTER:t.constructor.Event.FOCUSIN,i=e===Ft?t.constructor.Event.MOUSELEAVE:t.constructor.Event.FOCUSOUT;o.default(t.element).on(n,t.config.selector,(function(e){return t._enter(e)})).on(i,t.config.selector,(function(e){return t._leave(...

## Beispielangriff { #example-attack }

Stellen Sie sich vor, Sie bauen eine Möglichkeit, lokal einen KI-Agenten auszuführen.

Er stellt eine API bereit unter

```
http://localhost:8000/v1/agents/multivac
```

Es gibt auch ein Frontend unter

```
http://localhost:8000
```

/// tip | Tipp

Beachten Sie, dass beide denselben Host haben.

///

        public void write(TestOutputEvent event) {
            String prefix;
            if (event.getDestination() == TestOutputEvent.Destination.StdOut) {
                prefix = "  1> ";
            } else {
                prefix = "  2> ";
            }

            try {
                if (event.getMessage().equals("\n")) {
                    writer.write(event.getMessage());
                } else {