对比5款AI沙箱引擎的隔离能力，揭示其安全差异与潜在风险。
AI Code Sandboxes: A Comparative Security Study. Part 1 of 2 -- Engine-Level Properties (Attack Surface, Leakage, Stackability, CVE History, Patch Cadence, Fuzzing)
- 从攻击面、泄漏、可堆叠性等6个维度评估沙箱引擎隔离性能。
- 同一类引擎（如microVM）产品间差异大，但不同类间区分明显。
- 部分引擎缺乏持续外部测试，存在未被检测的安全盲区。
本文综合六项引擎级指标——1.1主机攻击面、1.2信息泄露、1.3纵深防御可堆叠性、1.4公开CVE历史、1.5补丁发布节奏、1.6上游模糊测试投入——分析五款AI沙箱产品如何将客机代码与主机内核隔离。单一维度不足以判断优劣，跨维度交叉分析才是核心。三大发现：(1) 引擎类型（microVM、用户态内核、OCI容器）在各架构维度上清晰分离，但同类型产品间无显著差异；(2) 产品策略（如锁定策略）是影响使用方安全的关键变量——协调披露下引擎补丁延迟约0天，而下游滞后可达0至471+天，甚至“不透明”至无穷；(3) 模糊测试投入分为三档，最强组合（microVM + 持续公开模糊测试器）在当前样本中未出现，导致‘0已公开漏洞 + 无上游模糊测试 + 无学术研究’交集区域始终无法测量。报告各轴排序、各产品画像及威胁模型定性矩阵；不提供整体排名。配套仓库（代码，Apache-2.0）：https://github.com/orbitalab/RnD-ai-sandboxes-sec-study-part-1。许可：CC BY 4.0。
原文摘要 · Abstract (English)
This paper reads six engine-level measurements together -- 1.1 host attack surface, 1.2 information leakage, 1.3 defense-in-depth stackability, 1.4 public CVE history, 1.5 patch cadence, and 1.6 upstream fuzzing posture -- to describe how five AI-sandbox products isolate guest code from the host kernel. No single axis is a sufficient basis for a comparative judgement; the cross-axis reading is the load-bearing analysis. Three high-level findings: (1) engine classes (microVM, userspace kernel, OCI container) separate cleanly on every architectural axis, but products within a class do not; (2) product pin policy is the dominant operator-facing variable -- engine-side patch latency aggregates to ~0 days for coordinated disclosures, while downstream lag spans 0 days to 471+ days to "opaque" to infinity; (3) fuzzing investment splits into three tiers, and the strongest combination -- microVM x continuous public fuzzer -- is unoccupied in this set, leaving the "0 published CVEs x no upstream fuzzer x no academic study" intersection structurally unmeasured. We report per-axis orderings, per-product portraits, and a threat-model qualification matrix; no overall ranking is proposed. Companion repository (code, Apache-2.0): https://github.com/orbitalab/RnD-ai-sandboxes-sec-study-part-1. License: CC BY 4.0.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。