Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A GitHub Issue Title Compromised 4k Developer Machines

grith.ai

Post reply on HN
Print view View original

151–160 of 216 posts

Re: A GitHub Issue Title Compromised 4k Developer Machines

#151

Post by Ukv »

sethops1 wrote: post #49
simlevesque wrote: post #34

What can Github do about this ?

Why should Github do anything? If you execute arbitrary instructions whether via LLM or otherwise, that's a you problem.

If I'm understanding the issue correctly, an action with read-only repo access shouldn't really be able to write 10GB of cache data to poison the cache and run arbitrary code in other less-restricted actions.

The LLM prompt injection was an entry-point to run the code they needed, but it was still within an untrusted context where the authors had forseen that people would be able to run arbitrary code ("This ensures that even if a malicious user attempts prompt injection via issue content, Claude cannot modify repository code, create branches, or open PRs.")

Re: A GitHub Issue Title Compromised 4k Developer Machines

#152

Post by ssgodderidge »

nstart wrote: post #125
yread wrote: post #106

> Cline’s (now removed) issue triage workflow ran on the issues event and configured the claude-code action with allowed_non_write_users: "*", meaning anyone with a GitHub account can trigger it simply by opening an issue. Combined with --allowedTools "Bash,Read,Write,Edit,Glob,Grep,WebFetch,WebSearch", this gave Claude arbitrary code execution within default-branch workflow. Has everyone lost their minds? AI agent w…

This is how people intend to run open claw instances too. Some folks are trying to add automated bug report creation by pointing agents at a company's social media mentions. I personally think it's crazy. I'm currently assisting in developing AI policies at work. As a proof of concept, I sent an email from a personal mail address whose content was a lot of angry words threatening contract cancellation and legal actio…

> Some folks are trying to add automated bug report creation by pointing agents at a company's social media mentions.

I wonder how long before we see prompt injection via social media instead of GitHub Issues or email. Seems like only a matter of time. The technical barriers (what few are left) to recklessly launching an OpenClaw will continue to ease, and more and more people will unleash their bots into the wild, presumably aimed at social media as one of the key tools.

Re: A GitHub Issue Title Compromised 4k Developer Machines

#153

Post by ssgodderidge »

stavros wrote: post #119
raincole wrote: post #86

Earlier quoted context omitted.

> Seem that github:cline/cline#b181e0 actually pointed to a forked respository with the malicious postinstall script. This seems to be a much bigger problem here than the fact it's triggered by an AI triage bot. I have to admit until one second ago I had been assuming if something starts with github:cline/cline it's from the same repo.

It was actually glthub/cline, as per the article, not github/cline.

The original report by the developer, Khan, mentions that github:cline/cline would also work[0].

> github:cline/cline#aaaaaaaa could point to a commit in a fork with a replaced package.json containing a malicious preinstall script.

[0] https://adnanthekhan.com/posts/clinejection/#the-prompt-inje...

Re: A GitHub Issue Title Compromised 4k Developer Machines

#154

Post by 5o1ecist »

yread wrote: post #106

> Cline’s (now removed) issue triage workflow ran on the issues event and configured the claude-code action with allowed_non_write_users: "*", meaning anyone with a GitHub account can trigger it simply by opening an issue. Combined with --allowedTools "Bash,Read,Write,Edit,Glob,Grep,WebFetch,WebSearch", this gave Claude arbitrary code execution within default-branch workflow. Has everyone lost their minds? AI agent w…

[dead]

Re: A GitHub Issue Title Compromised 4k Developer Machines

#155

Post by Cthulhu_ »

Ukv wrote: post #147
yread wrote: post #106

> Cline’s (now removed) issue triage workflow ran on the issues event and configured the claude-code action with allowed_non_write_users: "*", meaning anyone with a GitHub account can trigger it simply by opening an issue. Combined with --allowedTools "Bash,Read,Write,Edit,Glob,Grep,WebFetch,WebSearch", this gave Claude arbitrary code execution within default-branch workflow. Has everyone lost their minds? AI agent w…

> AI agent with full rights running on untrusted input in your repo? Boundary was meant to be that the workflow only had read-only access to the repository: > # - contents: read -> Claude can read the codebase but CANNOT write/push any code > [...] > # This ensures that even if a malicious user attempts prompt injection via issue content, > # Claude cannot modify repository code, create branches, or open PRs. https:/…

Yeah but this is the thing, that's just text. If I tell someone "you can't post on HN anymore", whether they won't is entirely up to them.

Permissions in context or text are weak, these tools - especially the ones that operate on untrusted input - need to have hard constraints, like no merge permissions.

Re: A GitHub Issue Title Compromised 4k Developer Machines

#157

Post by gzread »

PunchyHamster wrote: post #109
yread wrote: post #106

> Cline’s (now removed) issue triage workflow ran on the issues event and configured the claude-code action with allowed_non_write_users: "*", meaning anyone with a GitHub account can trigger it simply by opening an issue. Combined with --allowedTools "Bash,Read,Write,Edit,Glob,Grep,WebFetch,WebSearch", this gave Claude arbitrary code execution within default-branch workflow. Has everyone lost their minds? AI agent w…

Looking how LLMs somehow override logic and intelligence by nice words and convenience have been fascinating, it's almost like LLM-induced brain damage

I believe psychologists are already studying chatbot psychosis as a disease.

Re: A GitHub Issue Title Compromised 4k Developer Machines

#158

Post by gzread »

gregoryl wrote: post #123
PunchyHamster wrote: post #109

Earlier quoted context omitted.

Looking how LLMs somehow override logic and intelligence by nice words and convenience have been fascinating, it's almost like LLM-induced brain damage

When you empower almost anyone to make complex things, the average intelligence + professionalism involved plummets.

It's not about that. Yes we can expect things made by unskilled artisans to be of low quality, but low quality things existing is fine, and you made low quality things too when you started out programming.

What's new is people treating the chatbox as a source of holy truth and trusting it unquestioningly just because it speaks English. That's weird. Why is that happening?

Re: A GitHub Issue Title Compromised 4k Developer Machines

#159

Post by msdz »

m-hodges wrote: post #148
crote wrote: post #67

Earlier quoted context omitted.

No, the real problem is that people keep giving LLMs the ability to take nontrivial actions without explicit human verification - despite bulletproof input sanitization not having been invented yet! Until we do so, every single form of input should be considered hostile. We've already seen LLMs run base64-encoded instructions[0], so even something as trivial as passing a list of commit shorthashes could be dangerous:…

> despite bulletproof input sanitization not having been invented yet! I don’t think it can be.¹ ¹ https://matthodges.com/posts/2025-08-26-music-to-break-model...

Interesting article you’ve linked. I’m not sure I agree, but it was a good read and food for thought in any case.

Work is still being done on how to bulletproof input “sanitization”. Research like [1] is what I love to discover, because it’s genuinely promising. If you can formally separate out the “decider” from the “parser” unit (in this case, by running two models), together with a small allowlisted set of tool calls, it might just be possible to get around the injection risks.

[1] Google DeepMind: Defeating Prompt Injections by Design. https://arxiv.org/abs/2503.18813

Re: A GitHub Issue Title Compromised 4k Developer Machines

#160

Post by cindyllm »

PunchyHamster wrote: post #109
yread wrote: post #106

> Cline’s (now removed) issue triage workflow ran on the issues event and configured the claude-code action with allowed_non_write_users: "*", meaning anyone with a GitHub account can trigger it simply by opening an issue. Combined with --allowedTools "Bash,Read,Write,Edit,Glob,Grep,WebFetch,WebSearch", this gave Claude arbitrary code execution within default-branch workflow. Has everyone lost their minds? AI agent w…

Looking how LLMs somehow override logic and intelligence by nice words and convenience have been fascinating, it's almost like LLM-induced brain damage

[dead]
Post reply on HN