RE: https://mastodon.scot/@simon_brooke/116232834837623434
“The researchers suspect that Glassworm—the name they assigned to the attack group—is using LLMs to generate these convincingly legitimate-appearing packages. “At the scale we’re now seeing, manual crafting of 151+ bespoke code changes across different codebases simply isn’t feasible,” they explained. Fellow security firm Koi, which has also been tracking the same group, said it, too, suspects the group is using AI.”
What I don’t get is how this snippet passed code review regardless.
I mean, it’s clearly dodgy and the last line basically meaningless without the code being evaluated.
The real story here isn’t the invisible Unicode characters, it’s the lack of proper code review on code submissions.
59.3K Posts, 11.3K Following, 46.8K Followers · Social oncologist. I make small things. Unapologetically anti-genocide. Warning: May not fit your taxonomy. From Gaza? If you need to get verified, please go here: https://gaza-verified.org/join/ Want to donate to people in Gaza? Please see https://gaza-verified.org/donate/ My posts are licensed under Creative Commons Attribution-NonCommercial-ShareAlike (https://creativecommons.org/licenses/by-nc-sa/4.0/) 🍉🌻 🏳️🌈 🏳️⚧️ #SmallWeb #SmallTech #web #tech #privacy #humanRights #personhood #democracy #aral #fedi22 #searchable
Aral Balkan
Harald Eilertsen