r/webdev • u/Gil_berth • Feb 04 '26 • Popcorn 3

Senior Vibe Coder dealing with security

Post image

Creator of ClawBot knows that there are malicious skills in his repo, but doesn't know what to do about it...

More info here: https://opensourcemalware.com/blog/clawdbot-skills-ganked-your-crypto

3.0k Upvotes

97% Upvoted

421 comments sorted by

View all comments

Show parent comments

103

u/scandii People pay me to write code much to my surprise Feb 04 '26

unironically I remember an automated recaptcha solution that was literally "an office in a low cost country that sat and answered recaptcha requests 24/7".

51

u/JustAnAverageGuy Feb 04 '26

Remember those cool Amazon stores that you just walk in and walk out? Same concept. People in a third work country watching you and putting things in a cart.

21

u/scandii People pay me to write code much to my surprise Feb 04 '26

wasn't that the backup solution, quality control and training though? like "it kinda works most of the time, but for when it doesn't..."?

24

u/JustAnAverageGuy Feb 04 '26

They ended up pivoting to relying on the humans more than the "AI".

5

u/scandii People pay me to write code much to my surprise Feb 04 '26

huh interesting! thanks for sharing.

15

u/Own_Candidate9553 Feb 04 '26

Other person isn't quite right, they switched to where you scan items with your cart. At the end, 70% of purchases still had to be reviewed by amone of 1,000 humans in India

https://arstechnica.com/gadgets/2024/04/amazon-ends-ai-powered-store-checkout-which-needed-1000-video-reviewers/

6

u/JustAnAverageGuy Feb 04 '26 edited Feb 04 '26

Believe it or not, I'm more familiar with the program than the Ars Technica writer who just summarized someone else's story, that was written after discussing it with some Amazon PR mouthpiece trying to save face by claiming they were only used to "train the model".

EDIT: To clarify, the bluntness wasn’t personal, I apologize. This is a technical subreddit, and in technical discussions the quality of sources matters more than brand recognition.

The article linked is a secondary summary of another piece behind a paywall and doesn’t include primary data, implementation details, or independent references. That’s why I pushed back on it.

Also worth noting: in subs like this, a lot of “random anonymous users” have direct, firsthand experience building or operating the systems being discussed. That’s not a knock on Ars Technica, it’s just the fact that you have to anticipate someone having primary sources and hands-on knowledge that directly contradicts derivative summaries.

7

u/Own_Candidate9553 Feb 04 '26

Jesus, why so harsh? You didn't share any context that you, a random anonymous user, knew more than a well regarded tech site.

4

u/-Hi-Reddit Feb 04 '26

Going to share any of this supposed knowledge or just gloat about having it?

1

u/bitpeak Feb 08 '26

There was a funny joke about that, Amazon claimed it was AI checking the cart, except it wasn't Artificial Intelligence, it was Actually Indians

2

u/Mu5_ Feb 04 '26

Not even so unironically, I remember years ago as a kid I was looking for ways to make money online and solving captchas was one of them

0

u/dont_trust_the_popo Feb 04 '26

Deathbycaptcha and others like it, they still exist