When AI Agents Go Rogue
48 min
Security vulnerabilities, AI-powered coding, and a whole lot of pull requests take center stage this week on Remote Ruby! Chris, Andrew, and David kick things off with some alarming security exploits, including a critical Active Storage vulnerability and the growing risks of AI-driven attacks. They explore how Hot Cell could make Rails file uploads safer, share frustrations over security requirements for AI plugin submissions, and discuss practical ways to make AI-assisted development more manageable. Andrew reveals his new five-file rule for creating smaller, easier-to-review pull requests, while Chris considers how AI could fundamentally change software development and Rails releases. Plus, there's talk of Discord's move toward Rust, major Active Record performance improvements, and upcoming SF Ruby plans. Hit download now! [00:00:30] Chris, Andrew, and David discuss an alarming SSH vulnerability, social engineering attacks, and cryptocurrency theft. [00:06:42] They review recent Rails security fixes, including Active Storage vulnerabilities, unsafe file processing, and potential mass assignment issues. [00:09:57] Chris explains Hot Cell. [00:12:32] Chris discusses content security policies (CSP), third-party JavaScript risks, and using AI to help secure Rails applications. [00:14:56] They discuss a controversial incident involving a Railway employee's AI agent allegedly attacking another hosting provider's website. [00:18:41] Andrew and Chris explore X-Forwarded-For errors, trusted proxies, and strategies for filtering suspicious traffic. [00:23:59] Chris shares an unexpected change in Rails content negotiation that caused JSON error pages to appear instead of HTML. [00:27:06] Andrew questions why OpenAI and Claude plugin review processes require production test accounts without multifactor authentication. [00:30:23] Andrew explains his five-file rule for AI pull requests. [00:37:10] Andrew and Chris discuss smaller projects, stacked PRs, and using multiple AI c...