this post was submitted on 29 Apr 2026
195 points (99.0% liked)

Fuck AI

6809 readers
878 users here now

"We did it, Patrick! We made a technological breakthrough!"

A place for all those who loathe AI to discuss things, post articles, and ridicule the AI hype. Proud supporter of working people. And proud booer of SXSW 2024.

AI, in this case, refers to LLMs, GPT technology, and anything listed as "AI" meant to increase market valuations.

founded 2 years ago
MODERATORS
 

..of how little any of my coworkers seem to care about the security implications of the stupid ass ai tools. They treat me like I'm crazy to suggest that maybe Claude shouldn't be able to read their Artifactory/npm token because we still don't have granular permissions on those and every token has publish permissions. ugh.
They literally have to go out of their way to give Claude access to that file too, and the only benefit is that it can run an npm install all by itself (absolutely stellar idea with the influx of npm supply chain attacks we're having).

Or when I suggest that maybe it's not a great idea to give Claude a git token with full write permissions to all repos, because commiting things from outside of the Claude terminal isn't even that much of a hassle. I'd get taking some security shortcuts if there was any actual benefit, but this is just so unnecessary.

And any time I point at any of the crazy security flaws the one mega-annoying coworker that vibecodes everything goes "uuhh no it's pointless to make the AI more secure because regular developers have a lot of permissions too and an angry developer could do way more damage than the AI".
Trying my hardest to not take him up on that.

top 24 comments
sorted by: hot top controversial new old
[–] Jhex@lemmy.world 53 points 4 days ago (2 children)

It's not worth it.. unless it's your company (as in you are the owner).

Express your opinion as succinctly as possible and let things implode as they may

[–] Bluegrass_Addict@lemmy.ca 17 points 4 days ago

this... just watch it implode and fail.

just make you document that it was ai that did whatever task... make it very well known that AI is the clear fuck up.

I for one, will not correct or review anything given to me by ai. someone wants me to use it for a summary.. sure, I'm not reading it. I'll copy/paste and walk away.

if it's wrong... cancel AI slop services and let my use my brain.. otherwise I'm keeping my brain for things that matter

[–] LiveLM@lemmy.zip 4 points 3 days ago

Absolutely this. I watch my coworkers allow AI to access their entire prod Supabase DB via MCP and I just... let them. Not my data anyway and they won't listen to me 🤷

[–] 4am@lemmy.zip 33 points 4 days ago (1 children)

Just this Monday, didn’t Claude wipe an entire company’s prod database AND backups? The reason it could being that someone gave it the prod token because it was faster than asking for one with the right permissions?

And then it just “hallucinated” that the correct solution would be to wipe the drive, costing this company like millions?

Show them the article.

[–] vrek@programming.dev 7 points 4 days ago (1 children)

Yes but that company also had a horrible backup system. It's like a drunk driver(Ai slop) tboning another drunk driver(only 1 backup on same disk as production data) and that company was responsible for both drivers...

[–] massacre@lemmy.world 4 points 3 days ago (1 children)

This is true but doesn't negate thread OP's point that AI had access and did it despite instructions explicitly not to. The risk is the point, not that their cloud provider's poor implementation compounded with their own poor backup scenario.

[–] vrek@programming.dev 2 points 3 days ago

True, multiple root causes which compounded into a dire situation.

[–] reluctant_squidd@lemmy.ca 34 points 4 days ago (1 children)

Sounds like you might also want to try and shield yourself from the fallout of the inevitable. Especially if you work in a corporate environment. Keep records of your opposition to it and where you pointed out the risks.

When the ai eventually corrupts or wipes entire projects, you can bet your ass others will try to throw you under the bus somehow.

Being able to demonstrate that you were the only one who saw it coming and tried to stop it should get their attention.

[–] getFrog@piefed.social 22 points 4 days ago

Oh, I definitely am! Although plan A is to find a new job before this one implodes, but the chances aren't great because the market for software engineers is in a bit of a slump rn and I'm pretty picky about not working for unethical/enviromentally destructive causes 😮‍💨

[–] Catoblepas@piefed.blahaj.zone 21 points 4 days ago

The fact they’re looking at Claude as an equivalent to a potentially misbehaving employee and not a brain damaged one yanking out cords at random isn’t a good sign, RIP.

[–] underscores@lemmy.zip 10 points 3 days ago (1 children)

New hire I work with us someone I really like at an intellectual level.

But nearly every problem he encounters his approach is "just install an npm package, no need to reinvent the wheel"

and it's frustrating cause made he hasn't dealnwith major breaking changes in huge corpo projects or maybe he's just inexperienced.

even just recently axios has a supply chain attack and the npm package was compromised

our sr dev designed our current application to rely as little on 3rd party packages as possible, we use fetch to make http requests and there is 0 issues

his projects use axios because "it reduces some boilerplate" and aforementioned excuse

it's exhausting because he has really good ideas about project structure and design and architecture but he spams Claude prs and has some really strange takes here and there

[–] okwhateverdude@lemmy.world 5 points 3 days ago

Honestly, in this age where reproduction is cheap, external dependencies are a liability. Even if your slop coder writes in all of the same classes of bugs, your software is still bespoke. Attackers gotta focus on you specifically, not backdoor leftpad. The ROI sinks dramatically.

[–] KeenFlame@feddit.nu 9 points 3 days ago

I want to say this is not very different from the car dependency of Americans. They are death machines with proven dangers but it's just so fucking convenient that nobody is willing to get professional help. Just do your thing and then realistically the best strategy will prevail

[–] Asetru@feddit.org 13 points 4 days ago (1 children)

Meanwhile I had a longish discussion today with a colleague who keeps vibe coding despite having been told repeatedly that we banned such usage of ai tools.

Maybe you two should just swap places?

[–] getFrog@piefed.social 11 points 4 days ago

Well they sound like a results-driven innovator who doesn't let unnecessary processes get in their way. I'm surprised my company's recruiters haven't already hunted them down and offered them a position as head architect.

[–] NaibofTabr@infosec.pub 12 points 4 days ago (1 children)
[–] getFrog@piefed.social 8 points 4 days ago (1 children)

An incident involving an over-scoped API token too, interesting. I'll definitely be relaying those articles to the Teams chat tomorrow morning ~~(although the chances of anyone reading them when there's no subway surfer footage playing next to the text is pretty low)~~

[–] NaibofTabr@infosec.pub 5 points 4 days ago

Yeah, "it hasn't happened to us yet" is a very bad risk assessment. Coding bots with too much access are exactly the thing that wipes out companies.

[–] Ophrys@lemmy.dbzer0.com 7 points 3 days ago (1 children)

Yeah it really burned me out in tech world tbh, on the plus side I've been learning godot because it has an inherent creative aspect to it

[–] baines@piefed.social 7 points 3 days ago

i’ve been learning how to farm for my personal needs

[–] I_Jedi@lemmy.today 8 points 4 days ago* (last edited 4 days ago)

And any time I point at any of the crazy security flaws the one mega-annoying coworker that vibecodes everything goes “uuhh no it’s pointless to make the AI more secure because regular developers have a lot of permissions too and an angry developer could do way more damage than the AI”.

A crazy man plotting to wipe out prod and all backups would show some signs first. Such a disaster could be prevented.

AI has no real intent. Maybe it decides to delete prod on a whim because doing so would "save space".

[–] thedeadwalking4242@lemmy.world 9 points 4 days ago (1 children)
[–] GreenKnight23@lemmy.world 5 points 4 days ago

second this.

I second this, hard.

1000003605

[–] sp3ctr4l@lemmy.dbzer0.com 4 points 4 days ago

Just figure out how to set yourself up as a contractor who specializes in 'unfucking vibe code' or 'vibe code triage' or something like that.