We are doomed: https://grith.ai/blog/clinejection-when-your-ai-tool-installs-another

[jackryder@infosec.exchange]

@Migueldeicaza

[sempf@infosec.exchange]

@Migueldeicaza This isn't even funny. I mean it is, but it isn't at all, ya know? What have we done?

[schwa@mastodon.social]

@Migueldeicaza I dont even need to click the link…

[biglinter@mastodon.social]

@Migueldeicaza its the combinatory stuff that makes life so fascinating: https://techcrunch.com/2026/03/05/cursor-is-rolling-out-a-new-system-for-agentic-coding/?utm_source=dlvr.it&utm_medium=mastodon

[schwa@mastodon.social]

@Migueldeicaza "The workflow was configured with allowed_non_write_users: "*", meaning any GitHub user could trigger it by opening an issue."

Ok so i clicked the link

[madduci@mastodon.social]

@Migueldeicaza why is it always AI?

[cliffsesport@mastodon.social]

@Migueldeicaza something something secure by design

[hagbard@corteximplant.com]

@Migueldeicaza can someone pls explain for non techies like me?

[migueldeicaza@mastodon.social]

@schwa As long as you did not install Agentic Mastodon Extensions you should be fine :-)

[migueldeicaza@mastodon.social]

@hagbard AI systems are being rolled out without much care, with catastrophic consequences.

[schwa@mastodon.social]

@Migueldeicaza I am avoiding anything with a *claw style naming scheme.

[hagbard@corteximplant.com]

@Migueldeicaza thanks, sounds great

[slightlyoff@toot.cafe]

@Migueldeicaza I'm gonna be saying "AI means read == execute" every day until an early grave, aren't I?

[raymaccarthy@mastodon.ie]

@Migueldeicaza
"Why existing controls did not catch it

npm audit: The postinstall script installs a legitimate, non-malicious package (OpenClaw). There is no malware to detect."

My POV is that OpenClaw is one of the most malicious programs ever distributed. Baffling that people deliberately install it!

[raymaccarthy@mastodon.ie]

@Migueldeicaza
Sane people left github already?
https://docs.gitlab.com/user/project/import/github/

[johnbolton1122@mstdn.party]

@Migueldeicaza Looking for a smarter way to earn online?
This complete system shows you how to build income step by step — even if you’re a beginner.
✔ Easy to follow
✔ No technical skills required
✔ Limited time special price
📩 Message us for full details.

https://site-ylhjjre3i.godaddysites.com/

For more details :

https://www.facebook.com/share/1F1L47AFFe/

[retrimental@mastodon.social]

@slightlyoff @Migueldeicaza

That's a nice and easy way to sum up my issues with AI

[savetoleen@mastodon.social]

@jackryder @Migueldeicaza I am a mother trying to keep my children safe and fed during very difficult times.
My children need food and basic necessities.
We are going through very hard days and any help, even small, can make a big difference for my children.
Please donate if you can, or share this post
Link in bio😭💔🙏

[mez@mastodon.nz]

@Migueldeicaza @slightlyoff Decades of “never trust user input” thrown out the window for AI…

[bob_zim@infosec.exchange]

@schwa @Migueldeicaza I’ll get you next time, Gadget! Next time!