Today in InfoSec Job Security News:

[simonzerafa@infosec.exchange]

@GossiTheDog

So a supply chain attack or actually genuine commits (or a mix as camouflage?) 🤯

[nihkeys@mastodontti.fi]

@DJGummikuh @GossiTheDog The purpose of a system is what it does. IMO these are not accidents.

[da_667@infosec.exchange]

@GossiTheDog ladies and gentlemen, it's this stupid shit (tm) that we are paying up the ass for new SSDs and RAM for.

[androcat@toot.cat]

@hohokam @GossiTheDog

The LLM can fuck up your project much faster than human developers ever could.

[harrysintonen@infosec.exchange]

It's almost as if the language models are actually not intelligent at all.

Who would have thought!?

[cr0w@infosec.exchange]

@GossiTheDog If only a significant number of security practitioners could have seen it coming and warned people.

[derbruesseler@chaos.social]

@da_667 @GossiTheDog maybe it introduced them in the first place. Now its finding its own code.

[0xtero@ohai.social]

@GossiTheDog I like the part where people are using Claude to write CLAUDE.md to explain Claude about directory traversal.

Nothing in this supply chain could ever go wrong.

[s_bergmann@chaos.social]

@GossiTheDog It is interesting that these changes are attributed to a "user named Claude" and not to the "human using the agent named Claude". This is how diffusion of responsibility works, I guess.

[thomasfuchs@hachyderm.io]

@GossiTheDog you're just jealous because it will cure cancer and fix climate change

[drat@infosec.exchange]

@da_667 @GossiTheDog There's not enough press on the downstream effects this stupid shit (tm) causes for any non-giant corp including those kids trying to build home labs to learn (like mine).

[ectopod@hachyderm.io]

@GossiTheDog was it Next.js?

[etchedpixels@mastodon.social]

@GossiTheDog So you are saying there is a business opportunity following claude around projects with bug bounties

[hughsie@mastodon.social]

@GossiTheDog I guess the AI security scanners will clean this up with their automated scan and CVE requests.</joke>

[badsamurai@infosec.exchange]

@da_667 I demoed that very thing recently. Prompted up a form page and visually I could see a handful of basic JavaScript issues.

Ask Claude to review the code it generated for vulns using OWASP Top 10. And it finds them.

That’s just bonkers. Sure, a lazy initial prompt so it’s all my fault, really.

@GossiTheDog

[fennix@infosec.space]

@cR0w @GossiTheDog

[draeath@infosec.exchange]

@Drat @da_667 @GossiTheDog drink enough ethanol and you'll accomplish it!

[fennix@infosec.space]

@thomasfuchs @GossiTheDog

I mean, if climate change becomes fixed eventually there won't be any more cancer, so they aren't completely wrong.

[draeath@infosec.exchange]

@badsamurai @da_667 @GossiTheDog I've seen setups that run tests and such all in a closed loop, I suppose if one really wanted to "use" this shit, they could implement that sort of thing too.

It'll cause a shedload more token use (and electrical waste) but might mitigate some of the idiocy.

[alan@mindly.social]

@cR0w @GossiTheDog Where "a sufficient number" is defined as 125% of all existing and future security practitioners, certified or not.