225
Fed up with vibe coders, dev sneaks data-nuking prompt injection into their code (arstechnica.com)
submitted 5 months ago by to c/programming@programming.dev
40 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] 0 points 5 months ago* (15 children)

How to get yourself blacklisted by large sweeps of the FOSS community:

Step 1: Include any kind of undocumented subversive behaviour in your thing.

That's it, doesn't matter what the intent is, simply by demonstrating you are willing to include anything that is remotely subversive without being open about it is usually enough to get blacklisted by a lot of people, because if you did it once... who's to say you won't do it again, but possibly worse next time?

People are extremely coldly receptive to anytime a FOSS dev throws a sudden undisclosed anything in their tool, let alone one that is actively malicious.

If I'm gonna depend on work life on anything FOSS, I ain't touching anything like that, regardless of intent, with a 200 foot pole lol.

All it takes is one button click to get notified:

  • permalink
  • fedilink
  • source
  • hideshow 15 child comments
    •
  • [–] 3 points 5 months ago (1 child)

    it's not subversive. it's a string, it has no effect on the code output. Only a rogue bot would interpret it as anything except a string. No human user would ever encounter an issue.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 0 points 5 months ago

    And a line of code that deletes system32 is only meant to be interpreted by the CPU, not a human, too.

    Whats your point?

    Injected attacks that instruct an AI to perform a malicious action dont get absolved just because the attack vector us through an agent.

  • permalink
  • fedilink
  • source
  • parent
    • load more comments (13 replies)