[flagged]
A GitHub Issue Title Compromised 4k Developer Machines
21–30 of 216 posts
Re: A GitHub Issue Title Compromised 4k Developer Machines
#22Will anthropic also post some kind of fix to their tool?
Re: A GitHub Issue Title Compromised 4k Developer Machines
#23> The issue title was interpolated directly into Claude's prompt via ${{ github.event.issue.title }} without sanitisation.
It's astonishing that AI companies don't know about SQL injection attacks and how a prompt requires the same safeguards.
Re: A GitHub Issue Title Compromised 4k Developer Machines
#24The article should have also emphasized that GitHub's issues trigger is just as dangerous as the infamous pull_request_target. The latter is well known as a possible footgun, with general rule being that once user input enters the workflow, all bets are off and you should treat it as potentially compromised code. Meanwhile issues looks innocent at first glance, while having the exact same flaw.
EDIT: And if you think "well, how else could it work": I think GitHub Actions simply do too much. Before GHA, you would use e.g. Travis for CI, and Zapier for issue automation. Zapier doesn't need to run arbitrary binaries for every single action, so compromising a workflow there is much harder. And even if you somehow do, it may turn out it was only authorized to manage issues, and not (checks notes) write to build cache.
Re: A GitHub Issue Title Compromised 4k Developer Machines
#25The S in LLM stands for Security.
Yeah, LLMs are so sexy.
S- Security
E- Exploitable
X- Exfiltration
Y- Your base belong to us.
Re: A GitHub Issue Title Compromised 4k Developer Machines
#26> The issue title was interpolated directly into Claude's prompt via ${{ github.event.issue.title }} without sanitisation. It's astonishing that AI companies don't know about SQL injection attacks and how a prompt requires the same safeguards.
But you can't, can you? Everything just goes into the context...
Re: A GitHub Issue Title Compromised 4k Developer Machines
#27> The issue title was interpolated directly into Claude's prompt via ${{ github.event.issue.title }} without sanitisation. It's astonishing that AI companies don't know about SQL injection attacks and how a prompt requires the same safeguards.
There’s a known fix for SQL injection and no such known fix for prompt injection
Re: A GitHub Issue Title Compromised 4k Developer Machines
#28> The issue title was interpolated directly into Claude's prompt via ${{ github.event.issue.title }} without sanitisation. It's astonishing that AI companies don't know about SQL injection attacks and how a prompt requires the same safeguards.
But you can't, can you? Everything just goes into the context...
[deleted]
Re: A GitHub Issue Title Compromised 4k Developer Machines
#29A few years ago, we would have said that those machines got compromised at the point when the software was installed. That is, software that has lots of permissions and executes arbitrary things based on arbitrary untrusted input. Maybe the fix would be to close the whole that allows untrusted code execution. In this case, that seems to be a fundamental part of the value proposition though.
Re: A GitHub Issue Title Compromised 4k Developer Machines
#30Hmm, interesting. I wonder what their security email looks like. The email is on their Vanta-powered trust center. https://trust.cline.bot/
He seems to have tried quite a few times to let them know.