News for hackers. Stuff that matters.

A comment on Microsoft's open source tools were hacked to steal passwords of AI developers. Parent comment

Re:Microsoft's open source tools were hacked to steal passwo... by red_admiral on Tuesday June 09, 2026 @06:39AM (#48459241)
It feels to me like AI agents should be their own security principals and use access tokens generated speficically for them on the repos or orgs that they need access to. Handing an AI agent an access token "minted" for a human's account feels to me like the new "write the password on a post-it".
[ Parent | on HN ]
Re:Microsoft's open source tools were hacked to steal passwo... by Klathmon on Tuesday June 09, 2026 @07:39AM (#48459778)
This is what I'm advocating for.

Give each dev's AI agent its own identity with its own access controls and tokens and everything.

It helps solve both the access control and attribution issues

[ Parent | on HN ]
Re:Microsoft's open source tools were hacked to steal passwo... by silon42 on Tuesday June 09, 2026 @07:33AM (#48459709)
Not just AI agents... basically, if you cd Projects/foo, that should be it's own user (for running npm, etc) that should not have access to parent user data (probably including github tokens, etc).
[ Parent | on HN ]
Re:Microsoft's open source tools were hacked to steal passwo... by IX-103 on Tuesday June 09, 2026 @08:01AM (#48459972)
Why not both?
[ Parent | on HN ]
Re:Microsoft's open source tools were hacked to steal passwo... by matheusmoreira on Tuesday June 09, 2026 @03:08PM (#48466030)
> basically, if you cd Projects/foo, that should be it's own user

Agreed. I went further and turned that into its own isolated virtual machine. The credentials problem is really annoying though. AI agents need the access in order to be useful.

[ Parent | on HN ]
Re:Microsoft's open source tools were hacked to steal passwo... by notnaut on Tuesday June 09, 2026 @06:48AM (#48459307)
As long as there’s a way to deterministically tie a model call to a human user. I think a loss of culpability is something some companies are afraid of to some extent.
[ Parent | on HN ]
Re:Microsoft's open source tools were hacked to steal passwo... by etiennebausson on Tuesday June 09, 2026 @07:15AM (#48459529)
Loss of liability is what company are built for, see the meaning of LLC as an exemple.

Of course, it is only their employees that are impacted instead of their bottom line, they might be more tolerant?

[ Parent | on HN ]