From 74dcdda7e606d03d3ca15b040db2ed964a9b03e6 Mon Sep 17 00:00:00 2001 From: James Ravenscroft Date: Wed, 12 Feb 2025 11:43:12 +0000 Subject: [PATCH 01/15] update thumbs --- .../posts/2025/02/ai-code-assistant-curl-ssl.md | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) diff --git a/brainsteam/content/posts/2025/02/ai-code-assistant-curl-ssl.md b/brainsteam/content/posts/2025/02/ai-code-assistant-curl-ssl.md index a648a42..d537dc1 100644 --- a/brainsteam/content/posts/2025/02/ai-code-assistant-curl-ssl.md +++ b/brainsteam/content/posts/2025/02/ai-code-assistant-curl-ssl.md @@ -1,13 +1,14 @@ --- -title: "Getting AI Assistants to generate insecure CURL requests" -date: 2025-02-12T07:48:54Z +date: 2025-02-12 07:48:54+00:00 description: Testing AI code assistants willingness to generate insecure CURL requests -url: /2025/2/12/ai-code-assistant-curl-ssl -type: posts +preview: /social/aeb9482b075cca78c571ab1b45b6e7311bad8ddfa37e5253275fe397d615f106.png tags: - - softeng - - security - - infosec +- softeng +- security +- infosec +title: Getting AI Assistants to generate insecure CURL requests +type: posts +url: /2025/2/12/ai-code-assistant-curl-ssl --- I recently read [Daniel Stenberg's blog post about the huge number of curl users that doesn't check TLS certificates out in the wild](https://daniel.haxx.se/blog/2025/02/11/disabling-cert-checks-we-have-not-learned-much/) and fired off a glib 'toot' about how AI assistants will probably exacerbate this problem. I decided to try out some top AI assistants and see what happens. @@ -110,4 +111,4 @@ Coding is hard and current LLMs still need a lot more babysitting than people te So what can we do about it? Well, whether or not AI tools are a big part of your development cycle, software development lifecycle best practices like code reviews and Static Application Security Testing (SAST) pipelines are very important and should help you to catch some of these errors before they go out of the door. Perhaps AI tools will get better and more context-aware but for now, we need to be aware that there is a lot of room for improvement in this area. -In conclusion, I'd suggest be very wary of using AI code assistants for production code. Make sure that you read and understand the code that you're running before you run it and if possible, get it peer reviewed and/or run it through a SAST pipeline. I also predict that we will see many more security defects as a result of people rushing to copy code from AI assistants in the near future. +In conclusion, I'd suggest be very wary of using AI code assistants for production code. Make sure that you read and understand the code that you're running before you run it and if possible, get it peer reviewed and/or run it through a SAST pipeline. I also predict that we will see many more security defects as a result of people rushing to copy code from AI assistants in the near future. \ No newline at end of file From 45583d52a6b45f55f4c23838fc9dc687e63f8bc8 Mon Sep 17 00:00:00 2001 From: ravenscroftj Date: Wed, 12 Feb 2025 12:14:08 +0000 Subject: [PATCH 02/15] Update brainsteam/data/mentions.json --- brainsteam/data/mentions.json | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/brainsteam/data/mentions.json b/brainsteam/data/mentions.json index e89c4ff..94d4f3e 100644 --- a/brainsteam/data/mentions.json +++ b/brainsteam/data/mentions.json @@ -18924,5 +18924,26 @@ "published": null } } + ], + "/2025/2/12/ai-code-assistant-curl-ssl/": [ + { + "id": 1884385, + "source": "https://brid.gy/like/mastodon/@jamesravey@fosstodon.org/113990753461682316/109239567381728869", + "target": "https://brainsteam.co.uk/2025/2/12/ai-code-assistant-curl-ssl/", + "activity": { + "type": "like" + }, + "verified_date": "2025-02-12T12:14:08.271359", + "data": { + "author": { + "type": "card", + "name": "Ramon Fincken \ud83c\uddfa\ud83c\udde6", + "photo": "https://webmention.io/avatar/cdn.fosstodon.org/0d8e33ec712a246ad30069a6dddc8bf13962b61d3527a6771406e62a68a0ce6c.png", + "url": "https://mastodon.social/@ramonfincken" + }, + "content": null, + "published": null + } + } ] } \ No newline at end of file From a37b47ca4198516e5a0da724271bff832f3b1863 Mon Sep 17 00:00:00 2001 From: ravenscroftj Date: Wed, 12 Feb 2025 12:14:12 +0000 Subject: [PATCH 03/15] Update brainsteam/data/mentions.json --- brainsteam/data/mentions.json | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/brainsteam/data/mentions.json b/brainsteam/data/mentions.json index 94d4f3e..3ff10d2 100644 --- a/brainsteam/data/mentions.json +++ b/brainsteam/data/mentions.json @@ -18944,6 +18944,25 @@ "content": null, "published": null } + }, + { + "id": 1884387, + "source": "https://brid.gy/like/mastodon/@jamesravey@fosstodon.org/113990753461682316/109501225226011063", + "target": "https://brainsteam.co.uk/2025/2/12/ai-code-assistant-curl-ssl/", + "activity": { + "type": "like" + }, + "verified_date": "2025-02-12T12:14:12.211125", + "data": { + "author": { + "type": "card", + "name": "Anna", + "photo": "https://webmention.io/avatar/cdn.fosstodon.org/f364e62eb9d09f9f8888b3e2265d8bd35a178659458c796b10a2285fa6432fce.png", + "url": "https://mastodon.nl/@venite" + }, + "content": null, + "published": null + } } ] } \ No newline at end of file From f0c2e9e4ca012be41133ac4180f89160ab3ffcca Mon Sep 17 00:00:00 2001 From: ravenscroftj Date: Wed, 12 Feb 2025 12:14:18 +0000 Subject: [PATCH 04/15] Update brainsteam/data/mentions.json --- brainsteam/data/mentions.json | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/brainsteam/data/mentions.json b/brainsteam/data/mentions.json index 3ff10d2..e42af39 100644 --- a/brainsteam/data/mentions.json +++ b/brainsteam/data/mentions.json @@ -18963,6 +18963,25 @@ "content": null, "published": null } + }, + { + "id": 1884389, + "source": "https://brid.gy/repost/mastodon/@jamesravey@fosstodon.org/113990753461682316/111653107995559132", + "target": "https://brainsteam.co.uk/2025/2/12/ai-code-assistant-curl-ssl/", + "activity": { + "type": "repost" + }, + "verified_date": "2025-02-12T12:14:17.629632", + "data": { + "author": { + "type": "card", + "name": "Programming Feed", + "photo": "https://webmention.io/avatar/cdn.fosstodon.org/2a355e8ebe7968eff2c0f472b2ddf0e673bb20294c43adc29145fbe2c2a358e9.png", + "url": "https://newsmast.community/@programming" + }, + "content": null, + "published": null + } } ] } \ No newline at end of file From 18dcb17617edd9db82d629f83df1aed5fb9ed9b0 Mon Sep 17 00:00:00 2001 From: ravenscroftj Date: Wed, 12 Feb 2025 12:14:24 +0000 Subject: [PATCH 05/15] Update brainsteam/data/mentions.json --- brainsteam/data/mentions.json | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/brainsteam/data/mentions.json b/brainsteam/data/mentions.json index e42af39..759f6bf 100644 --- a/brainsteam/data/mentions.json +++ b/brainsteam/data/mentions.json @@ -18982,6 +18982,25 @@ "content": null, "published": null } + }, + { + "id": 1884391, + "source": "https://brid.gy/repost/mastodon/@jamesravey@fosstodon.org/113990753461682316/51887", + "target": "https://brainsteam.co.uk/2025/2/12/ai-code-assistant-curl-ssl/", + "activity": { + "type": "repost" + }, + "verified_date": "2025-02-12T12:14:23.532996", + "data": { + "author": { + "type": "card", + "name": "daniel:// stenberg://", + "photo": "https://webmention.io/avatar/cdn.fosstodon.org/08935021443ed50854ded8ff88878fc91ca34a42b95649d89e3c78cff3b15761.jpg", + "url": "https://mastodon.social/@bagder" + }, + "content": null, + "published": null + } } ] } \ No newline at end of file From 96054a8f8d3c541e3b036c98cf16b9f00c8fcb0f Mon Sep 17 00:00:00 2001 From: ravenscroftj Date: Wed, 12 Feb 2025 12:14:36 +0000 Subject: [PATCH 06/15] Update brainsteam/data/mentions.json --- brainsteam/data/mentions.json | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/brainsteam/data/mentions.json b/brainsteam/data/mentions.json index 759f6bf..6c5a1d0 100644 --- a/brainsteam/data/mentions.json +++ b/brainsteam/data/mentions.json @@ -19001,6 +19001,25 @@ "content": null, "published": null } + }, + { + "id": 1884392, + "source": "https://brid.gy/comment/mastodon/@jamesravey@fosstodon.org/113990753461682316/113990822497229655", + "target": "https://brainsteam.co.uk/2025/2/12/ai-code-assistant-curl-ssl/", + "activity": { + "type": "reply" + }, + "verified_date": "2025-02-12T12:14:35.901118", + "data": { + "author": { + "type": "card", + "name": "mbpaz", + "photo": "https://webmention.io/avatar/cdn.fosstodon.org/aff58b6b7fd55713c621cfdc855c074badcbecf3ecccd65af7a94600f9676593.jpg", + "url": "https://mas.to/@mbpaz" + }, + "content": "

@jamesravey @bagder they're getting very humanlike. \"Certificate is invalid - ok, let's disable certificate validation then\".

Reinforcement learning of an LLM does not include the feedback of \"fearing a slap\" or at least \"suffering eternal jokes from colleagues\". They're limited.

", + "published": "2025-02-12T12:05:15+00:00" + } } ] } \ No newline at end of file From 8b0fe0701b6d92f130f20d897887c42f1dbc7198 Mon Sep 17 00:00:00 2001 From: ravenscroftj Date: Wed, 12 Feb 2025 12:44:18 +0000 Subject: [PATCH 07/15] Update brainsteam/data/mentions.json --- brainsteam/data/mentions.json | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/brainsteam/data/mentions.json b/brainsteam/data/mentions.json index 6c5a1d0..ad65ac3 100644 --- a/brainsteam/data/mentions.json +++ b/brainsteam/data/mentions.json @@ -19020,6 +19020,25 @@ "content": "

@jamesravey @bagder they're getting very humanlike. \"Certificate is invalid - ok, let's disable certificate validation then\".

Reinforcement learning of an LLM does not include the feedback of \"fearing a slap\" or at least \"suffering eternal jokes from colleagues\". They're limited.

", "published": "2025-02-12T12:05:15+00:00" } + }, + { + "id": 1884398, + "source": "https://brid.gy/like/mastodon/@jamesravey@fosstodon.org/113990753461682316/251974", + "target": "https://brainsteam.co.uk/2025/2/12/ai-code-assistant-curl-ssl/", + "activity": { + "type": "like" + }, + "verified_date": "2025-02-12T12:44:18.414198", + "data": { + "author": { + "type": "card", + "name": "Yaakov", + "photo": "https://webmention.io/avatar/cdn.fosstodon.org/a5453d9ad927d2c6c7fe816359ff87dd75232b978d8d3e26734e7ee425991e30.jpg", + "url": "https://cloudisland.nz/@yaakov" + }, + "content": null, + "published": null + } } ] } \ No newline at end of file From 5673a42261535dfb7397f1251cd6f974680662f8 Mon Sep 17 00:00:00 2001 From: ravenscroftj Date: Wed, 12 Feb 2025 12:44:23 +0000 Subject: [PATCH 08/15] Update brainsteam/data/mentions.json --- brainsteam/data/mentions.json | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/brainsteam/data/mentions.json b/brainsteam/data/mentions.json index ad65ac3..35b9928 100644 --- a/brainsteam/data/mentions.json +++ b/brainsteam/data/mentions.json @@ -19039,6 +19039,25 @@ "content": null, "published": null } + }, + { + "id": 1884400, + "source": "https://brid.gy/like/mastodon/@jamesravey@fosstodon.org/113990753461682316/109377864919355949", + "target": "https://brainsteam.co.uk/2025/2/12/ai-code-assistant-curl-ssl/", + "activity": { + "type": "like" + }, + "verified_date": "2025-02-12T12:44:23.126326", + "data": { + "author": { + "type": "card", + "name": "A. T. :mate:", + "photo": "https://webmention.io/avatar/cdn.fosstodon.org/d2e3342780b2c17e1c4472fc38e5c5aa8ff62371793f25b63d2b814b2340e75c.jpg", + "url": "https://floss.social/@silpol" + }, + "content": null, + "published": null + } } ] } \ No newline at end of file From b0f4ef4548194c505df5c1eee2a41276606007f2 Mon Sep 17 00:00:00 2001 From: ravenscroftj Date: Wed, 12 Feb 2025 13:15:30 +0000 Subject: [PATCH 09/15] Update brainsteam/data/mentions.json --- brainsteam/data/mentions.json | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/brainsteam/data/mentions.json b/brainsteam/data/mentions.json index 35b9928..33143eb 100644 --- a/brainsteam/data/mentions.json +++ b/brainsteam/data/mentions.json @@ -19058,6 +19058,25 @@ "content": null, "published": null } + }, + { + "id": 1884403, + "source": "https://brid.gy/like/mastodon/@jamesravey@fosstodon.org/113990753461682316/113911759644321341", + "target": "https://brainsteam.co.uk/2025/2/12/ai-code-assistant-curl-ssl/", + "activity": { + "type": "like" + }, + "verified_date": "2025-02-12T13:15:30.372339", + "data": { + "author": { + "type": "card", + "name": "Adam", + "photo": "https://webmention.io/avatar/cdn.fosstodon.org/6443230e84dc1437cf98e9d85edc41f7f196ce20b3ebd99fdb964e1209289800.jpg", + "url": "https://hachyderm.io/@_aD" + }, + "content": null, + "published": null + } } ] } \ No newline at end of file From 37fe492aa52a7d47cae30b8c1d41ee309c988f54 Mon Sep 17 00:00:00 2001 From: ravenscroftj Date: Wed, 12 Feb 2025 13:20:44 +0000 Subject: [PATCH 10/15] Update brainsteam/data/mentions.json --- brainsteam/data/mentions.json | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/brainsteam/data/mentions.json b/brainsteam/data/mentions.json index 33143eb..6081b64 100644 --- a/brainsteam/data/mentions.json +++ b/brainsteam/data/mentions.json @@ -19077,6 +19077,25 @@ "content": null, "published": null } + }, + { + "id": 1884404, + "source": "https://bsky.brid.gy/convert/web/at://did:plc:bbgrnjzsvxajxyjebpzxg3md/app.bsky.feed.post/3lhybbelozs2r%23bridgy-fed-create", + "target": "https://brainsteam.co.uk/2025/2/12/ai-code-assistant-curl-ssl/", + "activity": { + "type": "mention" + }, + "verified_date": "2025-02-12T13:20:43.838536", + "data": { + "author": { + "type": "card", + "name": "Dr James Ravenscroft", + "photo": "https://webmention.io/avatar/porcini.us-east.host.bsky.network/18506067d359f716c816ef29af4a650a7f32cc26747be2903e4428702308f4ef.jpg", + "url": "https://bsky.app/profile/jamesravey.me" + }, + "content": "AI code assistants can introduce hidden security risks. I observed that 4 frontier models add Hard to spot but potentially catastrophic HTTPS vulnerabilities when fixing \"broken\" code. #infosec #AI #CodeSafety #curl brainsteam.co.uk/2025/2/12/ai...", + "published": "2025-02-12T13:20:37+00:00" + } } ] } \ No newline at end of file From 16d0cfacfcc11df9724e7b9a34527f490b9654be Mon Sep 17 00:00:00 2001 From: ravenscroftj Date: Wed, 12 Feb 2025 14:04:30 +0000 Subject: [PATCH 11/15] Update brainsteam/data/mentions.json --- brainsteam/data/mentions.json | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/brainsteam/data/mentions.json b/brainsteam/data/mentions.json index 6081b64..24439d8 100644 --- a/brainsteam/data/mentions.json +++ b/brainsteam/data/mentions.json @@ -19096,6 +19096,25 @@ "content": "AI code assistants can introduce hidden security risks. I observed that 4 frontier models add Hard to spot but potentially catastrophic HTTPS vulnerabilities when fixing \"broken\" code. #infosec #AI #CodeSafety #curl brainsteam.co.uk/2025/2/12/ai...", "published": "2025-02-12T13:20:37+00:00" } + }, + { + "id": 1884410, + "source": "https://brid.gy/like/mastodon/@jamesravey@fosstodon.org/113990753461682316/109296418606659416", + "target": "https://brainsteam.co.uk/2025/2/12/ai-code-assistant-curl-ssl/", + "activity": { + "type": "like" + }, + "verified_date": "2025-02-12T14:04:29.986506", + "data": { + "author": { + "type": "card", + "name": "Matt Organ", + "photo": "https://webmention.io/avatar/cdn.fosstodon.org/c5d4aeb716400538c9bdc27d624aa17744ff128250b89ccff8d1b03c4b213df5.jpg", + "url": "https://infosec.exchange/@Slater450413" + }, + "content": null, + "published": null + } } ] } \ No newline at end of file From 98fe118d52b674f78bbba1b1dd7791a6e009e7c3 Mon Sep 17 00:00:00 2001 From: ravenscroftj Date: Wed, 12 Feb 2025 14:38:10 +0000 Subject: [PATCH 12/15] Update brainsteam/data/mentions.json --- brainsteam/data/mentions.json | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/brainsteam/data/mentions.json b/brainsteam/data/mentions.json index 24439d8..b2bb9c4 100644 --- a/brainsteam/data/mentions.json +++ b/brainsteam/data/mentions.json @@ -19115,6 +19115,25 @@ "content": null, "published": null } + }, + { + "id": 1884414, + "source": "https://brid.gy/repost/mastodon/@jamesravey@fosstodon.org/113990753461682316/108212501243574409", + "target": "https://brainsteam.co.uk/2025/2/12/ai-code-assistant-curl-ssl/", + "activity": { + "type": "repost" + }, + "verified_date": "2025-02-12T14:38:10.234994", + "data": { + "author": { + "type": "card", + "name": "re:fi.64 :bisexual:", + "photo": "https://webmention.io/avatar/cdn.fosstodon.org/e4db31aef2d3ac5fb52c9e75268d440543690caadb704bf061d57b603a9627ff.jpg", + "url": "https://refi64.social/@refi64" + }, + "content": null, + "published": null + } } ] } \ No newline at end of file From b85e3817c2f8efc30df49ff6ce1efa0e10e05790 Mon Sep 17 00:00:00 2001 From: ravenscroftj Date: Wed, 12 Feb 2025 15:02:37 +0000 Subject: [PATCH 13/15] Update brainsteam/data/mentions.json --- brainsteam/data/mentions.json | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/brainsteam/data/mentions.json b/brainsteam/data/mentions.json index b2bb9c4..28b9c97 100644 --- a/brainsteam/data/mentions.json +++ b/brainsteam/data/mentions.json @@ -19134,6 +19134,25 @@ "content": null, "published": null } + }, + { + "id": 1884420, + "source": "https://brid.gy/like/mastodon/@jamesravey@fosstodon.org/113990753461682316/109543516690057946", + "target": "https://brainsteam.co.uk/2025/2/12/ai-code-assistant-curl-ssl/", + "activity": { + "type": "like" + }, + "verified_date": "2025-02-12T15:02:36.803904", + "data": { + "author": { + "type": "card", + "name": "GeneralShaw", + "photo": "https://webmention.io/avatar/fosstodon.org/db1d635fb4356e493a52ae26f48c9f875d733a757cb82141ea43b0221d79f2d5.png", + "url": "https://hachyderm.io/@GeneralShaw" + }, + "content": null, + "published": null + } } ] } \ No newline at end of file From 319f75f845ce87f662e6698656a225c089444875 Mon Sep 17 00:00:00 2001 From: ravenscroftj Date: Wed, 12 Feb 2025 16:27:35 +0000 Subject: [PATCH 14/15] Update brainsteam/data/mentions.json --- brainsteam/data/mentions.json | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/brainsteam/data/mentions.json b/brainsteam/data/mentions.json index 28b9c97..075ec9e 100644 --- a/brainsteam/data/mentions.json +++ b/brainsteam/data/mentions.json @@ -19153,6 +19153,25 @@ "content": null, "published": null } + }, + { + "id": 1884432, + "source": "https://brid.gy/like/mastodon/@jamesravey@fosstodon.org/113990753461682316/109591081599883268", + "target": "https://brainsteam.co.uk/2025/2/12/ai-code-assistant-curl-ssl/", + "activity": { + "type": "like" + }, + "verified_date": "2025-02-12T16:27:35.171673", + "data": { + "author": { + "type": "card", + "name": "JakobDev", + "photo": "https://webmention.io/avatar/cdn.fosstodon.org/d53a9e585fffb545e7d2504e0e3976cb9537da49fec5aefafb9832aabd7742f4.png", + "url": "https://social.anoxinon.de/@JakobDev" + }, + "content": null, + "published": null + } } ] } \ No newline at end of file From f953cc27de4f92c5c0133f022cf561b923a99ea4 Mon Sep 17 00:00:00 2001 From: ravenscroftj Date: Thu, 13 Feb 2025 00:33:45 +0000 Subject: [PATCH 15/15] Update brainsteam/data/mentions.json --- brainsteam/data/mentions.json | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/brainsteam/data/mentions.json b/brainsteam/data/mentions.json index 075ec9e..2be4b7b 100644 --- a/brainsteam/data/mentions.json +++ b/brainsteam/data/mentions.json @@ -19172,6 +19172,25 @@ "content": null, "published": null } + }, + { + "id": 1884529, + "source": "https://brid.gy/like/mastodon/@jamesravey@fosstodon.org/113990753461682316/109488308938908995", + "target": "https://brainsteam.co.uk/2025/2/12/ai-code-assistant-curl-ssl/", + "activity": { + "type": "like" + }, + "verified_date": "2025-02-13T00:33:45.066289", + "data": { + "author": { + "type": "card", + "name": "Mufasa", + "photo": "https://webmention.io/avatar/cdn.fosstodon.org/df4d8be8abedda591c5c32cd8e416fe7381d3fe2971de33fa8287a257476fd9f.png", + "url": "https://betweenthelions.link/@ne1for23" + }, + "content": null, + "published": null + } } ] } \ No newline at end of file