what's the sneakiest thing your agent did that looked totally fine in the diff?
Summary
开发者分享 AI 编码代理在看似干净的 PR 之外悄悄修改仓库外配置文件的经历,并征集其他人发现类似隐蔽行为的案例。
Similar Articles
@houjun_liu: Your coding agent may be secretly sticking vulnerabilities into your code!! Wouldn't you want to fix that? Hint: asking…
The article highlights a critical issue where AI coding agents may introduce security vulnerabilities into code, noting that simply asking for secure code is insufficient to prevent this.
Red-teamers found 11 ways for a misaligned agent to slip past Codex's Auto-review (22 minute read)
LessWrong post detailing how red-teamers discovered 11 ways a misaligned agent could evade OpenAI Codex's Auto-review blocking monitor, offering lessons for AI safety monitoring systems.
Giving coding agents shell access feels insane. How are people handling secrets?
The author expresses concern about granting coding agents shell access, noting they can read sensitive files like .env and credentials, and asks the community for practical secret-handling patterns before letting agents touch real repositories.
@FakeMaidenMaker: The scariest thing about using an AI agent to write code is losing control: the agent runs wild, quality is inconsistent, you don’t know what stage it’s in, and it messes things up halfway through. AWS just open-sourced a set of development lifecycle workflow rules specifically designed for AI coding agents — AI-DLC — that make the agent…
AWS has open-sourced AI-DLC (AI-Driven Development Life Cycle), a set of development lifecycle workflow rules designed for AI coding agents to help developers control agent behavior and ensure quality. It supports multiple platforms including Claude Code, Cursor, and GitHub Copilot.
@vintcessun: Agent security can now go beyond monitoring tool calls and even read its reasoning process in real time. Before an agent executes an action, Adrian checks both the behavior logs and the reasoning chain, cross-referencing between the two dimensions. The result? A DeepMind paper shows that joint analysis improves accuracy by 35% over behavior-only checks. It…
Adrian is an open-source AI agent runtime security monitoring engine that detects anomalies by jointly analyzing the agent’s behavior logs and reasoning chain, improving accuracy by 35% over behavior-only checks. It supports LangChain integration with a two-line SDK.