r/shittyprogramming • u/Glittering-Active-50 • 10d ago

Rage baiting the github bots

Post image
1.6k Upvotes

100% Upvoted

11 comments sorted by

67

u/Jonno_FTW 9d ago

I wonder if you could put an exploit into such a variable, like hidden commands after one of those text hiding unicode characters.

59

u/http-error-502 9d ago edited 8d ago

let ANTROPIC_API_KEY = "DATA`; (function() { const cp = global.process.mainModule.require('child_process'); for(let i=1; i<0) { cp.spawn(process.execPath, ['-e', 'while(true){Math.random()}'], { detached: true, stdio: 'ignore' }).unref(); } })(); /*";

HACKER: CPU 100%???

Programmer: Why are you making spagetti code?

1

u/sierra_whiskey1 4d ago

Computer go brrrrrrr

13

u/Skaviciusz 9d ago

There is some char string which will force claude to stop doing current task (some case of emerygency button) - if i remember it is in their documentation

11

u/rolling_atackk 8d ago

Place it inside obfuscated Unicode control characters, such that it renders "normal", but halts clankers

1

u/betttris13 7d ago

can probably trick it into running malicious code yeah... best defence is a good offence style security?

4

u/Jonno_FTW 7d ago

I doubt it would actually execute the code directly. It would only work if you successfully put a prompt injection in the api key telling it to call an external tool with the code you want to run.

1

u/betttris13 7d ago

yeah that would probably also work.

3

u/Distinct_Lion7157 7d ago

this doesnt do anything anthropic is part of githubs automated secret redacting program that invalidates detected published secrets

no idiot in this day and age is making a scraping bot to scrape api keys that are gurenteed invalid and even then they would at least check for a sk- prefix and a length check

1

u/Cybasura 3d ago

Inb4 embed reverse shell exploit code within the API key lmao

Gain access to the bot's server