News for hackers. Stuff that matters.

A comment on Microsoft's open source tools were hacked to steal passwords of AI developers. Parent comment

Re:Microsoft's open source tools were hacked to steal passwo... by silon42 on Tuesday June 09, 2026 @07:33AM (#48459709)
Not just AI agents... basically, if you cd Projects/foo, that should be it's own user (for running npm, etc) that should not have access to parent user data (probably including github tokens, etc).
[ Parent | on HN ]
Re:Microsoft's open source tools were hacked to steal passwo... by IX-103 on Tuesday June 09, 2026 @08:01AM (#48459972)
Why not both?
[ Parent | on HN ]
Re:Microsoft's open source tools were hacked to steal passwo... by matheusmoreira on Tuesday June 09, 2026 @03:08PM (#48466030)
> basically, if you cd Projects/foo, that should be it's own user

Agreed. I went further and turned that into its own isolated virtual machine. The credentials problem is really annoying though. AI agents need the access in order to be useful.

[ Parent | on HN ]