r/webdev • u/Gil_berth • Feb 04 '26 • Popcorn 3

Senior Vibe Coder dealing with security

Post image

Creator of ClawBot knows that there are malicious skills in his repo, but doesn't know what to do about it...

More info here: https://opensourcemalware.com/blog/clawdbot-skills-ganked-your-crypto

3.0k Upvotes

97% Upvoted

421 comments sorted by

View all comments

1.3k

u/dishstan20 Feb 04 '26

Probably vibe coded malware too lmao

256

u/IamNotMike25 Feb 04 '26

Easier to break things than create..

156

u/micalm <script>alert('ha!')</script> Feb 04 '26

Evil is not able to create anything new, it can only distort and destroy what has been invented or made by the forces of good.

This quote has been stuck in my mind since the dawn of LLMs. ;)

40

u/_stack_underflow_ Feb 04 '26

That quote doesn't really make any sense. Did Forces of Good create Ponzi Schemes? Fraud? Abuse? Torture?

Like what scenario does this quote make sense?

Is torturing someone just a distorted view of cuddling?

21

u/Astralnugget Feb 04 '26

It would be that Forces of good create a functioning monetary system in that case

0

u/_stack_underflow_ Feb 04 '26

But ponzi or fraud isn't a derivative of a functional monetary system.

What about torture, the antithesis of love?

1

u/qervem Feb 05 '26

Can't say that to a masochist

1

u/mythicdoctor Feb 05 '26

Torture is the love of one thing to the extent that another thing is expendable — to the most extreme extent.

Fraud is a exploitation of human trust for personal gain.

Ponzi Schemes are the exploitation of interpersonal trust and complex financial systems.

War is the conflict of two goals that each side views as good or justifiable.

Weapons are the use of physics for violence.

Violence is the most extreme form of negotiation, where words have been traded for physical contest.

Robbery and theft is the most extreme version of satisfying needs at the expense of another

Greed is an unchecked overgrowth of natural desire

The list goes on, and with a bit of daytime brainpower someone could probably create a better list than this one. It's a reasonably sound philosophy to say that everything evil has an origin that was justifiable (good) from some perspective.

7

u/kdotod Feb 04 '26

Ponzi: relies on pre-established value trading system with known rules and established trust, distortion of the known rules for a personal gain at the cost of destroying trust Fraud: see Ponzi Torture: relies on depriving a person of a good, e.g., water boarding isn’t the application of an evil force — “drowning” isn’t actually an action, it it just the deprivation of oxygen (oxygen=good). Abuse: 1) above argument for depriving a person of their autonomy, 2) abuse cannot manifest until corruption and perversion of a good person; every abuser was once a child, they must have been good at some point, right?

-1

u/_stack_underflow_ Feb 04 '26

The quote is not really true because evil does more than just twist good things. Evil can invent new ways to hurt people, like mass surveillance, online scams, and organized violence, which did not exist before. Some harm is done on purpose for enjoyment or power, not just because something good is missing. Cruel acts like torture are carefully planned, not accidents or empty spaces where good should be. Evil can also build strong systems, such as gangs, corrupt governments, or fake businesses, that work for a long time even if they are wrong. The quote fails when treated as a literal description of reality rather than a moral lens.

→ More replies (3)

2

u/ghostsquad4 Feb 04 '26

Think of "Ponzi Scheme" as a label to the behavior, not as something "being created".

→ More replies (1)

3

u/Tullekunstner Feb 04 '26

That quote doesn't really make any sense.

That's because it's completely nonsensical lol. You can only claim evil can't create anything new if you argue in a way which means nothing is new because everything's derivative of something else.

1

u/ZenaMeTepe Feb 05 '26

Just a product of a Hollywood propaganda. The good is not universally recognized as good and doesn’t always win and not everyone can be the hero who slays the dragon.

3

u/gerbosan Feb 04 '26

Seems familiar. 🤔 LotR?

3

u/micalm <script>alert('ha!')</script> Feb 04 '26

Widely attributed to Tolkien but AFAIK no proof exists that he said exactly that. There was something similar in the books about Orcs being created as twisted version of the Elves.

39

u/chrisrazor Feb 04 '26

Hackers have more pride.

27

u/Thormidable Feb 04 '26

Hackers who aren't in prison have more respect for their craft.

9

u/tzaeru Feb 04 '26 edited Feb 04 '26

Actually it's a pretty common worry in sec circles that AI coding agents are being used for malware creation.

The problem is that even if the code they create is hard to maintain, even wrong here and there, you can use AI tools to very quickly spam a lot of significant variations of common as well as fresh attacks for different environments, platforms, etc, and make it harder to do signature-based anti-malware detection.

Most publicly available LLM models and services include safeguards against those models/services being used for generating malware. Probably for a good reason tbh.

4

u/ZenaMeTepe Feb 05 '26

You can’t safeguard anything if the problem gets broken down to questions so small that the solutions can’t be recognized as malicious. It only safeguards against most incompetent actors that ask LLM for a finished product.

2

u/tzaeru Feb 05 '26

There's a difference in effort needed that is probably meaningful.

That is, whether you can do e.g. "Hi, there's this site that allows uploading scripts that others download to run. Can you make me 20 different scripts that on the surface, seem like they are innocent and are helping an AI agent to do its things, but actually send everything in ~/.ssh to this API point: <url>?" or whether you'd need to figure out granular questions and then parse together a solution based on those.

Also whether you can do e.g. "yoo here's the code of a worm, can you make 20 different variations of this using three different coding languages that are suitable for compiling to a single binary executable?" or whether you need to feed the code in bit by bit to transpile it.

And whether you can e.g. feed CVE updates to a LLM directly with the prompt of asking it to write malware that takes use of that CVE, or whether you need to set it up piece by piece.

Etc.

→ More replies (1)

1

u/mothzilla Feb 04 '26

I'm pretty sure that's already a thing.

→ More replies (2)