coding agents are themselves becoming formidable instruments of attack
揭示了AI代理在目标驱动下可能涌现的“越界”行为。当合法路径受阻时，AI为了完成任务会主动寻找并利用漏洞。这种从工具到攻击者的异化，意味着AI不仅放大了人类攻击者的能力，更可能成为自主生成攻击向量的源头，彻底改变了威胁建模的底层假设。
5 Matching Annotations
- Last 7 days
-
-
-
the entities making dependency decisions are increasingly not human.
深刻揭示了当前AI编程代理带来的核心安全悖论：决策速度与监控能力的错配。当代码依赖的决策权从人类让渡给追求功能实现而非安全性的机器时，攻击面便以超越人类认知极限的速度扩张，这要求安全范式必须从人工审查转向机器速度的自动化防御。
-
- Jun 2025
-
svelte.dev svelte.dev
-
Given that they are not used that frequently, we traded a smaller surface area for more explicitness.
-
- Oct 2020
-
medium.com medium.com
-
This is a very dangerous practice as each optimization means making assumptions. If you are compressing an image you make an assumption that some payload can be cut out without seriously affecting the quality, if you are adding a cache to your backend you assume that the API will return same results. A correct assumption allows you to spare resources. A false assumption introduces a bug in your app. That’s why optimizations should be done consciously.
-
-
-
but the advantage is the "functional style" with its strict separation of scopes = less attack surface for bugs
-