Today in InfoSec Job Security News:

[thomasfuchs@hachyderm.io]

@GossiTheDog you're just jealous because it will cure cancer and fix climate change

[drat@infosec.exchange]

@da_667 @GossiTheDog There's not enough press on the downstream effects this stupid shit (tm) causes for any non-giant corp including those kids trying to build home labs to learn (like mine).

[ectopod@hachyderm.io]

@GossiTheDog was it Next.js?

[etchedpixels@mastodon.social]

@GossiTheDog So you are saying there is a business opportunity following claude around projects with bug bounties 8)

[hughsie@mastodon.social]

@GossiTheDog I guess the AI security scanners will clean this up with their automated scan and CVE requests.</joke>

[badsamurai@infosec.exchange]

@da_667 I demoed that very thing recently. Prompted up a form page and visually I could see a handful of basic JavaScript issues.

Ask Claude to review the code it generated for vulns using OWASP Top 10. And it finds them.

That’s just bonkers. Sure, a lazy initial prompt so it’s all my fault, really.

@GossiTheDog

[fennix@infosec.space]

@cR0w @GossiTheDog

[draeath@infosec.exchange]

@Drat @da_667 @GossiTheDog drink enough ethanol and you'll accomplish it!

[fennix@infosec.space]

@thomasfuchs @GossiTheDog

I mean, if climate change becomes fixed eventually there won't be any more cancer, so they aren't completely wrong.

[draeath@infosec.exchange]

@badsamurai @da_667 @GossiTheDog I've seen setups that run tests and such all in a closed loop, I suppose if one really wanted to "use" this shit, they could implement that sort of thing too.

It'll cause a shedload more token use (and electrical waste) but might mitigate some of the idiocy.

[alan@mindly.social]

@cR0w @GossiTheDog Where "a sufficient number" is defined as 125% of all existing and future security practitioners, certified or not.

[draeath@infosec.exchange]

@nihkeys @DJGummikuh @GossiTheDog I don't think that phrase allows for incompetency in design. The purpose is what was intended, not what actually results. There is a distinction.

[dlakelan@mastodon.sdf.org]

@GossiTheDog
The real question is why does a bot have commit privileges on a "major web framework"?

i mean the answer is probably because google owns the repo probably... but why?

[draeath@infosec.exchange]

@s_bergmann @GossiTheDog I like how AIDER uses co-authors, so you can't escape from blame. All these tools should be doing similar!

[violetmadder@kolektiva.social]

@nihkeys @DJGummikuh @GossiTheDog

The damage is the point.

It's a weapon.

Not sure I'd call it a "targeted" attack, when the goal is to flood absolutely EVERYTHING with shit everywhere.

[ftp_alun@infosec.exchange]

@GossiTheDog fault injection into production code at scale. Nice.

[spinnyspinlock@infosec.exchange]

@GossiTheDog I became used to checking projects I am checking out for claude (etc) in the source files and commits really fast

[ptesarik@infosec.exchange]

@etchedpixels Bug bounties? You know nothing about business…
You set up a giant scam tool, let venture capital pay for its development, then use it to hack the world and sell all of it:

• license use of the tool,
• hacking applications,
• vulnerability scanning,
• protection racket from affected companies.

That' how real capitalists do business.
The tool is called Claude.
@GossiTheDog

[tarheel@mstdn.io]

@etchedpixels @GossiTheDog

Gahhh. Takes a little effort to imagine LESS rewarding work.

[keith_lawson@mastodon.social]

@GossiTheDog This was literally the first major security mistake I made in my early days as a Perl developer and I don't imagine it's that uncommon. Claude has probably been trained with a truckload of code with these vulnerabilities.

That's okay because we run everything in single-purpose Docker containers now though, right? /s