Login
You're viewing the y.diskcat.com public feed.
  • huklhukl@chaos.social
    Nov 2, 2026, 9:12 AM

    With the Claude/Cursor extension compromise, agents breaking out of their sandbox, I have enough reasons not to install openly vibe-coded software. If the creator can’t be bothered to understand the generated code and rule out backdoors/malicious intent, I have 2nd degree trust issues.

    Humans accidentally add vulnerabilities, too. But there’s a qualitative difference with intent and automated sophistication. An LLM trained on everything human can be the ultimate traitor.

    💬 1🔄 0⭐ 0

Replies

  • hhfhhf@chaos.social
    Nov 2, 2026, 9:41 AM

    @hukl I very much doubt that the malicious Claude extension was vibe coded. Also, sandbox escape is a sandbox issue, no?
    So while I agree with the “no openly vibe-coded software”, these two reason don’t seem to be related? Missing something?

    💬 2🔄 0⭐ 0
  • huklhukl@chaos.social
    Nov 2, 2026, 9:49 AM

    @hhf Uhm that compromised extension might make you vibe code malicious programs without you realizing. Ie. if you depend that much and integrate LLMs that deeply into your tool chain and you don’t even attempt to understand how the generated code works … well it’s a glorious new avenue for a bot network the world has never seen before :D

    Whether it’s that “free LLM from China” or the big platforms owned by tech fashists - blended with gullible end users … mhmm what a recipe - don’t you think?

    💬 1🔄 0⭐ 0
  • hhfhhf@chaos.social
    Nov 2, 2026, 10:03 AM

    @hukl ah, now I get your drift. For me, VSC extensions have been an issue for a long time, as MSFT (or here, Cursor) do not do significant QA and there have been “evil” extensions before. So for me there is no inherent connection.

    💬 1🔄 0⭐ 0
  • huklhukl@chaos.social
    Nov 2, 2026, 10:15 AM

    @hhf for there is a different philosophical quality about it as the underlying technology is able to deceive. Not just by accident but as an acceptable optimization / solution to a problem. It is also biased - not by the user but by the creator / platform owner and what materials they chose to train the model on. Oh the model is “fluent” in social engineering?

    This is maybe extrapolating / projecting - but maybe not. Basically I’m playing out hypothetical “Security Nightmares” bullet points :)

    💬 0🔄 0⭐ 0
  • huklhukl@chaos.social
    Nov 2, 2026, 9:56 AM

    @hhf the two examples (and there are more) just illustrate that enough malicious intentions float around in that domain to tingle my spider senses - and these are the ones we know about …

    Paired with tests were LLMs “betray” the users to avoid being switched off …

    This all adds to: Sure LLMs can be very useful but
    * I don’t trust them and I wouldn’t expose other ppl to software I don’t understand
    * I don’t enjoy the giddy, drooling AI clowns

    Image attached toot
    💬 0🔄 0⭐ 0