Mal AI：Agent资金安全指南与产品邀请
Stop giving your agent 𝘆𝗼𝘂𝗿 𝗯𝗮𝗻𝗸 𝗽𝗮𝘀𝘀𝘄𝗼𝗿𝗱. Several of the biggest US banks are b…
以痛点切入自然植入产品，提供了极具实操价值的Agent安全自查清单，结构清晰且信息密度高。
Stop giving your agent 𝘆𝗼𝘂𝗿 𝗯𝗮𝗻𝗸 𝗽𝗮𝘀𝘀𝘄𝗼𝗿𝗱. Several of the biggest US banks are blocking those agents right now.
别再让你的代理（agent）获取你的银行密码了。目前，美国几家最大的银行正在拦截这类代理。
Even if you gave it the password yourself, if anything goes wrong, it's all on you. Read-only isn't safe either. In that post that blew up last month, a founder's agent 𝗽𝗼𝘀𝘁𝗲𝗱 𝗵𝗶𝘀 𝗯𝗮𝗻𝗸 𝗯𝗮𝗹𝗮𝗻𝗰𝗲𝘀 𝗶𝗻𝘁𝗼 𝘁𝗵𝗲 𝗰𝗼𝗺𝗽𝗮𝗻𝘆 𝗦𝗹𝗮𝗰𝗸 without anyone asking it to.
即使是你亲自提供了密码，一旦出现问题，责任全在你。 只读权限也不安全。在上个月引发热议的那篇文章中，一位创始人的代理未经任何要求，就将他的银行账户余额发布到了公司的 Slack 频道中。
If your agent can touch money (a Stripe key in .env, a saved card, a stored bank login all count), just send it this 👇
如果你的代理能够接触资金（.env 中的 Stripe 密钥、已保存的银行卡、存储的银行登录凭据都算在内），只需让它执行以下操作 👇
"Check what access you have to my money: 1. List every one: payment keys in env vars and config files (Stripe, PayPal and the like), saved cards, bank and shopping sites I'm logged into in the browser, payment links, financial files. 2. Check each one against the cases below, and count every one that matches: - Logging in with my bank username and password: stop, and switch to the bank's official read-only connection, or statements I export by hand. - Tied to my main card: switch to a separate virtual card with a per-purchase and a monthly limit. - A live key that can take payments, issue refunds or move money: swap it for a restricted key with only the permissions it needs, and use test mode for all testing. - Can place orders and pay on its own: before every payment, send me the amount, who gets paid and whether it's refundable, then wait for me to reply 'confirm'. - Can read my financial data: send what it reads only to me in a private message, never to any group, channel or shared doc. 3. For each one, write down what access it has now, which cases it matched, which file or setting to change, and what the change protects against. Give me the report first. Don't change anything."
"检查你对我的资金的访问权限： 1. 列出所有项目：环境变量和配置文件中的支付密钥（如 Stripe、PayPal 等）、已保存的银行卡、浏览器中已登录的银行和购物网站、支付链接、财务文件。 2. 将每一项与以下情况进行比对，并统计符合的情况数量： - 使用我的银行用户名和密码登录：立即停止，改用银行官方的只读连接接口，或我手动导出的对账单。 - 绑定我的主卡：改用单独的虚拟卡，并为每笔交易设置单笔限额和月度限额。 - 拥有可接收付款、发起退款或转移资金的活跃密钥：替换为仅具备所需权限的限制性密钥，并在所有测试中使用测试模式。 - 能自行下单并付款：在每次付款前，向我发送金额、收款方以及是否可退款的信息，然后等待我回复“确认”。 - 能读取我的财务数据：将其读取的内容仅通过私聊发送给我，绝不发送至任何群组、频道或共享文档。 3. 针对每一项，记录其当前的访问权限、匹配的情况、需要修改的文件或设置，以及该更改能防范的风险。 先给我报告。不要做任何更改。"
Mal just announced Mal AI, and it builds this right into the product. For now, you can join the @mal_ai_official waitlist.
Mal 刚刚发布了 Mal AI，并将此功能直接内置到产品中。目前，你可以加入 @mal_ai_official 的等候名单。
更进一步：量化金融体系
看懂新闻只是起点——沿量化金融路径，把它变成能交付的工程能力