The only way to mitigate this risk is to verify package names manually and never assume a package mentioned in an AI-generated code snippet is real or safe.
We're doomed
this post was submitted on 12 Apr 2025
65 points (100.0% liked)
Cybersecurity
7069 readers
2 users here now
c/cybersecurity is a community centered on the cybersecurity and information security profession. You can come here to discuss news, post something interesting, or just chat with others.
THE RULES
Instance Rules
- Be respectful. Everyone should feel welcome here.
- No bigotry - including racism, sexism, ableism, homophobia, transphobia, or xenophobia.
- No Ads / Spamming.
- No pornography.
Community Rules
- Idk, keep it semi-professional?
- Nothing illegal. We're all ethical here.
- Rules will be added/redefined as necessary.
If you ask someone to hack your "friends" socials you're just going to get banned so don't do that.
Learn about hacking
Other security-related communities [email protected] [email protected] [email protected] [email protected] [email protected]
Notable mention to [email protected]
founded 2 years ago
MODERATORS
I can’t imagine how a “black box” that is AI can ever be anything but a security risk. Compounding the problem are lazy developers that push code that they do not fully understand.
But it’s sTaTiStiCaLlY ReLeVaNt…
Generating dependencies is a huge weak point of ai right now. Version numbers are typically made up or very out of date at best. I just assume they're wrong from the start now.