Why would I want a slower moving release cycle for an app I use for banking and other personal stuff, whilst the latest models are finding CVEs left right and center? Get outta here with your slow-moving fork.
"However, managers also had to grapple with a few dozen regressions in the resulting code, pointing to AI’s ongoing challenges in understanding Rust. "
The problem isn't rust or understanding rust. Agents make plenty of mistakes in mainstream languages like JavaScript and C#. The off-hand deflection signals, to me, that whoever came up with that excuse has far too much faith in the bots. We do have to check their code, and we will find errors.
While I largely agree, I suspect languages which require more memory management awareness, especially when they have opt out options like `unsafe`, will remain more challenging for the models. They have a tendency to turn things off to "pass the test"
on the PR topic tho: my latest challenge is putting out my rage fires after people lazily post a claude (or other aigen) review without any understanding themselves, forcing me to defend the code against agent errors. Yes, there are also useful things in there, but people are getting lazy - since "coding is solved", they seem to think PRs are also solved :/
ha, ironically, the average person will say the blog post is ai-generated because of the liberal usages of actual emdashes. I was literally shooed as a bot for using regular dashes recently :/
What makes this effective is the tagging (when done - it's not always done, and that could be a problem) - apparently the tagging process involves the stalker being court-ordered to wear a tamper-resistent ankle bracelet, a little like the ones people have to wear when under house arrest, but with a much farther reach: instead of being wirelessly tethered to a radio receiver in their home, the stalker tags upload GPS co-ordinates continuously, from wherever the wearer is.
yep, this is why people just chuck Claude reviews on my PRs, and why I bothered to set up sandboxing for Claude, so I can make the agent run a review before I take it to PR, so that at the very least, I can add commentary that steers Claude away from bad assumptions when it doesn't seem to understand the business domain, or how things are generally done. Tho, to be fair, it's also found some nifty edge cases in review, so there is some value there - things just fall over when someone can't be arsed to do more than point claude at it and copy-paste the results to the PR. And the people who were bad at review before (ask stupid questions, fight about stuff they don't understand) are just as annoying now, but they feel vindicated because they got Claude to do it, and they will take no responsibility for the time they waste (not that they ever did).
It is an example of an indirect prompt injection: malicious prompt is injected in the content (spreadsheet file in this case) not in user prompt (instructions for the agent to pick the best offer). The file content, while looking benevolent to a human tricks an AI agent to perform actions (make decisions) in the interest of the attacker as opposed to the human user.
Other examples include job applications, refund requests, dispute remediation, etc. Virtually any situation in which a decision based on externally provided content is delegated to an AI agent.
This (indirect prompt injection) is a pretty serious threat. It is usually easy to pull off for attackers and yet it flies under the radar for users that are running such agents. In this case the agent can be properly sandboxed and use capable, modern models. The input files all look clean and reasonable. And yet the attacker can reliably trick the agent.
reply