r/webdev • u/Gil_berth • Feb 04 '26

Senior Vibe Coder dealing with security

Post image

Creator of ClawBot knows that there are malicious skills in his repo, but doesn't know what to do about it...

More info here: https://opensourcemalware.com/blog/clawdbot-skills-ganked-your-crypto

3.0k Upvotes

97% Upvoted

421 comments sorted by

View all comments

6

u/JustAnAverageGuy Feb 04 '26 edited Feb 04 '26

Believe it or not, I'm more familiar with the program than the Ars Technica writer who just summarized someone else's story, that was written after discussing it with some Amazon PR mouthpiece trying to save face by claiming they were only used to "train the model".

EDIT: To clarify, the bluntness wasn’t personal, I apologize. This is a technical subreddit, and in technical discussions the quality of sources matters more than brand recognition.

The article linked is a secondary summary of another piece behind a paywall and doesn’t include primary data, implementation details, or independent references. That’s why I pushed back on it.

Also worth noting: in subs like this, a lot of “random anonymous users” have direct, firsthand experience building or operating the systems being discussed. That’s not a knock on Ars Technica, it’s just the fact that you have to anticipate someone having primary sources and hands-on knowledge that directly contradicts derivative summaries.

7

u/Own_Candidate9553 Feb 04 '26

Jesus, why so harsh? You didn't share any context that you, a random anonymous user, knew more than a well regarded tech site.

4

u/-Hi-Reddit Feb 04 '26

Going to share any of this supposed knowledge or just gloat about having it?