6 ms·

>>a few lines of own (LLM generated) code. ... and now you've switched the attack vector to a hostile LLM.

• zelphirkalt 1y ago
  Though you will see the code at least, when you are copy pasting it and if it is really only a few lines, you may be able to review it. Should review it of course.
  • LtWorf 1y ago
    If it's that little review the dependency.
    • lukan 1y ago
      The difference is, the dependency can change and is usually way harder to audit. Subfolders in subfolder, 2 lines here in a file, 3 line there vs locking at some files and check what they do.
• appreciatorBus 1y ago
  Sure but that's a one time vector. If the attacker didn't infiltrate the LLM before it generated the code, then the code is not going to suddenly go hostile like an npm package can.
• lukan 1y ago
  I did not say to do blind copy paste. A few lines of code can be audited.