Today in InfoSec Job Security News:

[gossithedog@cyberplace.social]

Today in InfoSec Job Security News:

I was looking into an obvious ../.. vulnerability introduced into a major web framework today, and it was committed by username Claude on GitHub. Vibe coded, basically.

So I started looking through Claude commits on GitHub, there’s over 2m of them and it’s about 5% of all open source code this month.

https://github.com/search?q=author%3Aclaude&type=commits&s=author-date&o=desc

As I looked through the code I saw the same class of vulns being introduced over, and over, again - several a minute.

[da_667@infosec.exchange]

@GossiTheDog

[djgummikuh@mastodon.social]

@GossiTheDog so would you consider this mass accidents or a targeted supply-chain attack?

[drat@infosec.exchange]

@da_667 @GossiTheDog I wish that juice actually existed...

[masek@infosec.exchange]

@GossiTheDog Consistency: so important

[da_667@infosec.exchange]

@GossiTheDog what's funny to me, is that there were influencers on linkedin a few days ago claiming claudecode could find vulnerabilities in code faster than humans, and they're like "look at all these openssl vulns it found!" now I'm like. "well no shit its finding vulnerabilities, when its the one introducing them."

[hohokam@mastodon.sdf.org]

@GossiTheDog sure, but it did that so much faster than a human could!

[drat@infosec.exchange]

@da_667 @GossiTheDog I will create the viruses and then sell my antivirus product to protect you

[simonzerafa@infosec.exchange]

@GossiTheDog

So a supply chain attack or actually genuine commits (or a mix as camouflage?) 🤯

[nihkeys@mastodontti.fi]

@DJGummikuh @GossiTheDog The purpose of a system is what it does. IMO these are not accidents.

[da_667@infosec.exchange]

@GossiTheDog ladies and gentlemen, it's this stupid shit (tm) that we are paying up the ass for new SSDs and RAM for.

[androcat@toot.cat]

@hohokam @GossiTheDog

The LLM can fuck up your project much faster than human developers ever could.

[harrysintonen@infosec.exchange]

It's almost as if the language models are actually not intelligent at all.

Who would have thought!?

[cr0w@infosec.exchange]

@GossiTheDog If only a significant number of security practitioners could have seen it coming and warned people.

[derbruesseler@chaos.social]

@da_667 @GossiTheDog maybe it introduced them in the first place. Now its finding its own code.

[0xtero@ohai.social]

@GossiTheDog I like the part where people are using Claude to write CLAUDE.md to explain Claude about directory traversal.

Nothing in this supply chain could ever go wrong.

[s_bergmann@chaos.social]

@GossiTheDog It is interesting that these changes are attributed to a "user named Claude" and not to the "human using the agent named Claude". This is how diffusion of responsibility works, I guess.

[thomasfuchs@hachyderm.io]

@GossiTheDog you're just jealous because it will cure cancer and fix climate change

[drat@infosec.exchange]

@da_667 @GossiTheDog There's not enough press on the downstream effects this stupid shit (tm) causes for any non-giant corp including those kids trying to build home labs to learn (like mine).

[ectopod@hachyderm.io]

@GossiTheDog was it Next.js?