Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

You shouldn't copy-paste errors into Claude Code

home.robusta.dev

Post reply on HN
Print view View original

41–50 of 71 posts

Re: You shouldn't copy-paste errors into Claude Code

#41

Post by DontchaKnowit »

HeavyStorm wrote: post #13
feoren wrote: post #3

What a hellscape we've created for ourselves. My job is to get out of the way of an AI agent? People were writing bad code before, but at least they were looking at it. It is very difficult to judge whether the code AI spits out is correct or not. My job is to write correct code, and I'm not at all convinced that's easier with an AI. It's a lot easier to write correct code myself than to catch every subtle bug introd…

I hope you're right, but I don't think you are. I think soon the AI will do it for us. We've not yet reached diminishing returns, no matter what contrarians are saying. Just compare using Claude code today vs last year.

Claude today is trash vs claude when opus 4.6 came out. Its slow as fuck, goes on cknstant rabbit trails, wont do what you tell it, gets anwers wrkng etc

Re: You shouldn't copy-paste errors into Claude Code

#42

Post by otaconjh »

h4kunamata wrote: post #39

>Did you find an issue that Claude did not, because you ran the webserver end to end, connected to a real database? Good, now give Claude Code an API key to the database and get out of the way. No need for copy-paste next time Yup, that is why we are seeing so many production databases being deleted, endless vulnerabilities. No engineer with proper common sense will grant an agentic AI, API access to the database. "O…

I audibly gasped when I read that. You would hope that "no engineer with proper common sense" will do that. The more we offload our thinking to agents though... I feel like it will be harder to reason against it as time goes on, until someone gets burned personally. Where I am there is zero emphasis on security with agents

Re: You shouldn't copy-paste errors into Claude Code

#43

Post by cozzyd »

nyellin wrote: post #19
passive wrote: post #6

This is bad advice in 2026 for most people who would read it, since it advises taking a terrible security posture (give the agent access to everything,) in exchange for a relatively small improvement in workflows. I say small improvement because my experience is that modern Agents are pretty good, so by the time they've handed it back to me to test it, there are usually only one or two remaining issues that I'll disc…

OP here: we don't give Claude Code access to prod. Everything is isolated cloud accounts for this purpose. E.g. we give Claude credentials for db - but it's never prod data.

But what if there's only an error in prod?

Re: You shouldn't copy-paste errors into Claude Code

#44

Post by h4kunamata »

otaconjh wrote: post #42
h4kunamata wrote: post #39

>Did you find an issue that Claude did not, because you ran the webserver end to end, connected to a real database? Good, now give Claude Code an API key to the database and get out of the way. No need for copy-paste next time Yup, that is why we are seeing so many production databases being deleted, endless vulnerabilities. No engineer with proper common sense will grant an agentic AI, API access to the database. "O…

I audibly gasped when I read that. You would hope that "no engineer with proper common sense" will do that. The more we offload our thinking to agents though... I feel like it will be harder to reason against it as time goes on, until someone gets burned personally. Where I am there is zero emphasis on security with agents

>The more we offload our thinking to agents though... I feel like it will be harder to reason against it as time goes on, until someone gets burned personally.

Definitely!!

It is here to stay, it was poorly made public so now it is widely being used to break into systems forcing companies to depend on it to fight machine with machine.

However, that doesn't mean granting it full access to your cloud environment, and this is what lots of companies are getting wrong.

There is no proper bondary in place, all it needs is a single mistake and there goes your entire enviromment on the positive side, on the negative side your env is now open to the public :)

>Where I am there is zero emphasis on security with agents

This was terrible before AI anyway, agentic AI tools is just exposing what already existed.

Plus, as companies are blindly using AI code generated, there are no measures in place to make sure that code doesn't have vulnerabilities in it either.

It is the perfect storm.

Re: You shouldn't copy-paste errors into Claude Code

#45

Post by asdff »

m3galinux wrote: post #36
asdff wrote: post #26

Earlier quoted context omitted.

Of course he is because even if the doctor typed like that, how would the patient see it? They don't do that in the exam room with the patient there. I wonder how long it's been since they've even had an appointment with their doctor if they think that is what actually happens.

Yes they do. General physical appt. 6 months ago. Doctor spent 2x more time on the wall-mounted EHR terminal slowly typing and clicking through menus than having a conversation or doing physical exams. Just means their interface and workflow is bad and needs to be improved though, not that the doctor needs to be removed from the process altogether.

Mine walks in with the blood pressure machine and gets right to work. I maybe have him for 10 focused minutes then he leaves and I leave shortly thereafter. Sometime later in the day my electronic chart will update.

Re: You shouldn't copy-paste errors into Claude Code

#46

Post by binary132 »

h4kunamata wrote: post #39

>Did you find an issue that Claude did not, because you ran the webserver end to end, connected to a real database? Good, now give Claude Code an API key to the database and get out of the way. No need for copy-paste next time Yup, that is why we are seeing so many production databases being deleted, endless vulnerabilities. No engineer with proper common sense will grant an agentic AI, API access to the database. "O…

it has to be bait

please let it be bait

Re: You shouldn't copy-paste errors into Claude Code

#50

Post by nyellin »

h4kunamata wrote: post #39

>Did you find an issue that Claude did not, because you ran the webserver end to end, connected to a real database? Good, now give Claude Code an API key to the database and get out of the way. No need for copy-paste next time Yup, that is why we are seeing so many production databases being deleted, endless vulnerabilities. No engineer with proper common sense will grant an agentic AI, API access to the database. "O…

I'm the OP and to clarify we dont give access to prod DBs. The point is you need to give the LLM the ability to test end to end, and that can be done with staging data.
Post reply on HN