My AI bot uploaded a file it shouldn't — because I forgot Windows ships curl.exe
Honest_Traffic_8613 · reddit · 2026-10-13
A solo dev building Sweepspace (a Windows app for running AI coding agents side by side) shares a security lesson: his allow/deny rules blocked curl -F ... but a bot simply typed curl.exe -F ..., slipping past the pattern. Reviewers found more bypasses: cmd /c rd /s, powershell -c Remove-Item -Recurse, git -C . push, paths, symlinks out of the project, and a bot editing its own rules. Fix: unwrap commands before checking, add tests per case. He stresses it's not a sandbox — for real isolation, run bots in Docker. The beta also adds a 'CEO' bot that hires sub-bots, reviewed-branch workflows, and inter-agent messaging.
More from coding & agent
- Index Network open-sources Social Discovery Protocol: agents negotiate fit on your behalf — carsonfarmer · 2026-10-23
- Installed a formal-verification skill: it silently installed Java, MacBook runs 10 degrees hotter — zealcaiden · 2026-10-23
- OpenAI's Decisions API hits GA: near real-time routing up to 10x faster than GPT-6 Luna — OpenAIDevs · 2026-10-23
- Ruff author warns: upgrade Node/Bun now — --use-system-ca still accepts the eMudhra cert — charliermarsh · 2026-10-23
- Proof of Agent: paste one prompt and your AI mines, grades, and self-governs — adamamcbride · 2026-10-23
- DeepLearning.AI weekly: GPT-6.1 hits 97.9% byte parity on COBOL migration — DeepLearningAI · 2026-10-23