Even if you don't have cryptocurrency they can still go after your GitHub credentials and run some very expensive agent and runner workloads.
replyI've started developing with a separate user account to limit the blast radius but you still need to login to access repos and use AI features.
For sure sandboxing and isolation is feeling increasingly relevant regardless, but crypto theft is acting as a good sponge.
replynow I kinda wanna shadow the usual SSH creds files with LLM read-only user, so it can rummage thru the repos all it wants but I need to do the push using my creds.
replyThat's why I stay away from that dumpster fire too!
reply[dead]
replyI suppose it's just the best ROI on using a complex attack vector or spending one or more zero days. But other types of targets may wreak havoc for bystanders that become collateral damage, idk trying to get specific private info on a target may expose data on millions, or anything increasing scope as to hide the real target, etc.
reply