Conversation

Notices

1. Embed this notice
   Kevin Beaumont (gossithedog@cyberplace.social)'s status on Tuesday, 17-Feb-2026 00:04:30 JST Kevin Beaumont

   Today in InfoSec Job Security News:

   I was looking into an obvious ../.. vulnerability introduced into a major web framework today, and it was committed by username Claude on GitHub. Vibe coded, basically.

   So I started looking through Claude commits on GitHub, there’s over 2m of them and it’s about 5% of all open source code this month.

   As I looked through the code I saw the same class of vulns being introduced over, and over, again - several a minute.

   • Soatok Dreamseeker repeated this.
   • Embed this notice
     Rich Felker (dalias@hachyderm.io)'s status on Tuesday, 17-Feb-2026 06:54:16 JST Rich Felker

     in reply to

     @GossiTheDog We need tools that scrape the list of repos that have accepted this shit, and either ban them or pin them to pre-slop versions/forks in dependency systems.

   • Embed this notice
     Rich Felker (dalias@hachyderm.io)'s status on Tuesday, 17-Feb-2026 07:18:39 JST Rich Felker

     in reply to

     • unusnemo

     @unusnemo A repo that has AI slop anywhere it its git history isn't FOSS and has maintainers who have shown gross irresponsibility. Banning use of it as a dependency should not be controversial.

   • Embed this notice
     unusnemo (unusnemo@friendica.rogueproject.org)'s status on Tuesday, 17-Feb-2026 07:18:40 JST unusnemo

     in reply to

     • Rich Felker

     @dalias

     I agree with your concept as being a noble idea. I just do not see it as a realistic solution. These are my issues with your idea, and you may not agree with me that if fine. Your idea is that we make tools to scrape repos on git servers (and perhaps SVN as it is still used) and validate that it is accepting pull requests from AI. If I have understood you. My take on that is that if you are working on a project then you should be forking the main repository not some other person's random fork. Main repositories tend to be a lot more responsible in who they accept pull requests from. In any of these Claude infested repos was even a single one the projects actual main repository? I would guess no. If developers are practicing good OPSEC then this is a none issue. So we are adding strain on servers that is simply not required.

     As developers we have a responsibility to our own integrity and are users to be sure that what we do release is as secure as we can make it. There is no such thing as completely secure software. It does not exist in reality.

     It is easy to get upset at such events. Though in the big picture is not a real issue, it is one of those issues that will be self-healing. I do not know a single developer that would not check who commits, are they using security measures like commit signing, is the project secure as is. Before forking, if they wanted to use it as a base and it did not meet those criteria they would hard fork and not participate in the original repo. Keep in mind that there are projects out there entirely written by AI, I do not endorse them, but they do exist.

     It is okay to not agree with me, I am okay with that. I do not feel as if we should be censoring source code for developers. I feel like we should be teaching them about good OPSEC & DEVOPs instead. Just my opinion.

     Have a great day!

   • Embed this notice
     da_667 (da_667@infosec.exchange)'s status on Wednesday, 18-Feb-2026 00:34:01 JST da_667

     in reply to

     @GossiTheDog

   • Embed this notice
     kwayk42 (kwayk42@sechtor.social)'s status on Wednesday, 18-Feb-2026 00:35:02 JST kwayk42

     in reply to

     • da_667

     @da_667 @GossiTheDog took me a while but I finally thought of something :

     Who says AI hasn't generated any real value? It's doing wonders for the threat actors

   • Embed this notice
     kwayk42 (kwayk42@sechtor.social)'s status on Wednesday, 18-Feb-2026 00:35:03 JST kwayk42

     in reply to

     • da_667

     @da_667 @GossiTheDog

     Soatok Dreamseeker repeated this.
   • Embed this notice
     Kevin Beaumont (gossithedog@cyberplace.social)'s status on Thursday, 23-Apr-2026 02:29:08 JST Kevin Beaumont

     in reply to

     The press have found out about this now. https://www.forbes.com/sites/the-wiretap/2026/04/22/anthropics-claude-is-pumping-out-vulnerable-code-cyber-experts-warn/