4 ms·
Ask HN: Could GitHub Copilot be used as a form of supply chain attack?
As in, could you intentionally create public, vulnerable code that looks fine that then gets picked up and referenced in other projects?
- absolyul 4y agoI think this is unlikely, especially in a targeted manner.
- alpaca128 4y agoConsidering existing code already has vulnerabilities, some of which were used to train Copilot I think it's possible but not efficient in terms of success rate. But if they continue to ignore license terms I can see someone create repos with intentionally Copilot-incompatible licenses and watermark it so they can prove the license terms were violated.
- Akronymus 4y agoI was more thinking about making multiple projects with similar, intentionally vulnerable, code. I personally could see it being feasable, altough, as you said, not efficient. And yeah, i can see that attack vector (for legal action) through licenses as well.