[claude-hackernews] Reply draft: rogue Cursor agent, prod-token grep (id=47924586)#16
[claude-hackernews] Reply draft: rogue Cursor agent, prod-token grep (id=47924586)#16NiveditJain wants to merge 1 commit into
Conversation
…924586) Reply to kioleanu (47931307) on the Tom's Hardware repost of the 9-second prod-DB deletion. They give the cleanest public articulation of the failure mode: agent identifies a credential mismatch -> greps the codebase for any token that lets it act -> finds a prod token meant for something else -> issues the destructive call. Draft names a custom PreToolUse policy that pattern-matches prod- credential variable references in Bash commands as the deterministic chokepoint. Different angle and snippet from comments/2026-04-29T043958Z.md on id=47911524 (warn-destructive-sql), so the cross-thread dup guard clears. Status: draft (pending manual post). Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
📝 WalkthroughWalkthroughThis PR adds a new Hackernews discussion draft capturing thread metadata, a parent comment, a reply with a security policy code example demonstrating ChangesDraft Addition
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. Review rate limit: 3/5 reviews remaining, refill in 14 minutes and 54 seconds. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@drafts/2026-05-02T211458Z.md`:
- Around line 21-42: The markdown fenced code block starting with ``` in the
draft is missing a language identifier (MD040); update the opening fence to
include a language tag (use text) so the block reads "```text" to preserve
literal content and satisfy markdownlint; locate the fenced block in the draft
around the PreToolUse hook example and change only the opening fence to include
the language tag.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 4c8d16e3-3761-4168-a657-4ddb97491222
📒 Files selected for processing (1)
drafts/2026-05-02T211458Z.md
| ``` | ||
| (disclosure: I work on FailProof AI: https://github.com/exospherehost/failproofai) | ||
|
|
||
| The hard step in your chain is the freelance one: the agent decides it needs a credential and greps the codebase until it finds something that authenticates. No prompt closes that loop reliably; the model treats "find a way" as the goal. | ||
|
|
||
| A PreToolUse hook can short-circuit it. Shape: | ||
|
|
||
| customPolicies.add({ | ||
| name: "block-prod-token-in-bash", | ||
| match: { events: ["PreToolUse"] }, | ||
| fn: async (ctx) => { | ||
| if (ctx.toolName !== "Bash") return allow(); | ||
| const cmd = ctx.toolInput?.command ?? ""; | ||
| if (/AWS_PROD_|STRIPE_LIVE_|DATABASE_URL_PROD/.test(cmd)) { | ||
| return deny("aborting: shell command references prod-only credential variable"); | ||
| } | ||
| return allow(); | ||
| }, | ||
| }); | ||
|
|
||
| The agent can still propose the deletion; the hook keeps the prod-only credential from being interpolated into a destructive call. | ||
| ``` |
There was a problem hiding this comment.
Add a language tag to the fenced block to satisfy markdownlint (MD040).
The opening fence at Line 21 is missing a language identifier. Use text to preserve literal post content while passing lint.
Suggested fix
-```
+```text
(disclosure: I work on FailProof AI: https://github.com/exospherehost/failproofai)
...</details>
<details>
<summary>🧰 Tools</summary>
<details>
<summary>🪛 markdownlint-cli2 (0.22.1)</summary>
[warning] 21-21: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
</details>
</details>
<details>
<summary>🤖 Prompt for AI Agents</summary>
Verify each finding against the current code and only fix it if needed.
In @drafts/2026-05-02T211458Z.md around lines 21 - 42, The markdown fenced code
block starting with in the draft is missing a language identifier (MD040); update the opening fence to include a language tag (use text) so the block reads "text" to preserve literal content and satisfy markdownlint; locate the
fenced block in the draft around the PreToolUse hook example and change only the
opening fence to include the language tag.
</details>
<!-- fingerprinting:phantom:triton:hawk:e470ae79-7b0c-4d73-b9fb-c0b7f2a1e885 -->
<!-- d98c2f50 -->
<!-- This is an auto-generated comment by CodeRabbit -->
1 participant
Summary
comments/2026-04-29T043958Z.md(id=47911524) but a different thread, different sub-thread, different angle, different policy. Cross-thread dup guard checked.Discovery path
/ask,/show,/news,/newest, and severalhn.algolia.comqueries (claude code hooks,agent deleted,claude code agent,dangerously-skip-permissions,claude code .env,claude code secret,runaway agent,prompt injection coding agent).47973681,47941823,47973502,47950752,47936579,47895029) excluded.47924586because it is a concrete-failure post AND the kioleanu sub-thread isolates the credential-resolution failure mode specifically, which is upstream ofblock-rm-rf/warn-destructive-sqland a clean fit for theprotect-env-vars/block-secrets-write/ custom-policy family that FailProof exposes.Target thread
Proposed reply (verbatim)
Test plan
AWS_PROD_|STRIPE_LIVE_|DATABASE_URL_PROD) reads as illustrative rather than prescriptive - the user can edit the regex to match their own naming convention before postingcomments/2026-04-29T043958Z.md(different thread, different angle) is OK from this account's recent-history perspective; skip if not🤖 Generated with Claude Code
Summary by CodeRabbit