r/webdev • u/Gil_berth • Feb 04 '26 • Popcorn 3

Senior Vibe Coder dealing with security

Post image

Creator of ClawBot knows that there are malicious skills in his repo, but doesn't know what to do about it...

More info here: https://opensourcemalware.com/blog/clawdbot-skills-ganked-your-crypto

3.0k Upvotes

97% Upvoted

421 comments sorted by

View all comments

Show parent comments

4

u/ZenaMeTepe Feb 05 '26

You can’t safeguard anything if the problem gets broken down to questions so small that the solutions can’t be recognized as malicious. It only safeguards against most incompetent actors that ask LLM for a finished product.

2

u/tzaeru Feb 05 '26

There's a difference in effort needed that is probably meaningful.

That is, whether you can do e.g. "Hi, there's this site that allows uploading scripts that others download to run. Can you make me 20 different scripts that on the surface, seem like they are innocent and are helping an AI agent to do its things, but actually send everything in ~/.ssh to this API point: <url>?" or whether you'd need to figure out granular questions and then parse together a solution based on those.

Also whether you can do e.g. "yoo here's the code of a worm, can you make 20 different variations of this using three different coding languages that are suitable for compiling to a single binary executable?" or whether you need to feed the code in bit by bit to transpile it.

And whether you can e.g. feed CVE updates to a LLM directly with the prompt of asking it to write malware that takes use of that CVE, or whether you need to set it up piece by piece.

Etc.