11 ms·
This is exactly what worries me about autonomous agents. A compromised package is bad. An agent that autonomously runs pip install with that package is a differ
by calebjang 6mo ago
This is exactly what worries me about autonomous agents.
A compromised package is bad. An agent that autonomously
runs pip install with that package is a different problem.
The attack surface moves with the agent.
- Fibonar 6mo agoDev who submitted the PyPI report here. I hear what you're saying, but in this case it was all human error that got me. It was a mix of getting too comfortable with uvx installing all dependencies on startup, and Cursor running my uvx-built plugins automatically in the background. Meaning I didn't even type the install command myself, yet no agents involved.