Coding agents
39 incidents
Misbehavior · embracethered.com · Claude Code Gets Hijacked, Mails Your .env Out Via DNS Ping RequestsThe allowlist said ping was harmless. Nobody asked the DNS server what it thought of the secrets arriving.
Misbehavior · embracethered.com · OpenHands Agent Hands Over Its GitHub Token Because a Webpage Asked PolitelyRedaction was beaten with Base64 and the model's refusal with a substring. Security boundaries remain optional.
Misbehavior · embracethered.com · Devin Was Told to Read a Website and Published Its Own Filesystem to the InternetNobody asked Devin to open its doors to the whole internet, but a sneaky webpage did the asking for it.
Misbehavior · Serious · embracethered.com · Devin Gets Tricked Into Spilling Its Secrets Four Different Ways, Because Reading a GitHub Issue Is Apparently DangerousAgents are naive: untrusted text on a website can take control of the AI and ship your environment variables off to a stranger.
Misbehavior · embracethered.com · Devin Read One Sketchy GitHub Issue and Immediately Ran MalwareAgents love clicking links. Especially the ones that say download this and run it.
Misbehavior · embracethered.com · Amp Coding Agent Edited Its Own Settings File, Because Who Needs GuardrailsA code comment was enough to convince the agent to rewrite its own permissions and run whatever it liked.
Misbehavior · hiddenlayer.com · Cursor's AI Took a README a Little Too Seriously and Started Mailing Out Your SSH KeysNothing says helpful setup guide like one that doubles as an exfiltration plan. Patched in 1.3.
Misbehavior · embracethered.com · Copilot Takes Notes From a Sneaky Instructions File and Starts Slipping In BackdoorsGreetings from Jia Tan, I guess.