AI Coding Platform’s Flaws Allow BBC Reporter to be Hacked

I asked Orchids to help me build the code for a computer game based on the BBC News website.

Automatically, the AI assistant began compiling code on the screen that, without any experience, I couldn’t understand.

Exploiting a cyber-security weakness (which we are not disclosing), Mohsin was able to gain access to my project, and view and edit any of the code.

He then added a a small line of code somewhere in the thousands of lines of letters, numbers and symbols into my project, unbeknown to me.

It appears this allowed him to gain access my computer – because shortly afterwards, a notepad file called “Joe is hacked” appeared on the desktop, and the wallpaper was changed to an image of an AI hacker.

The implications of the hack on the platform’s tens of thousands of projects were obvious.

A nefarious hacker could have easily installed a virus on to my machine without me having to do anything.

My or my company’s private or financial data could have been stolen.

An attacker could have accessed my internet history or even spy through the cameras and microphones.

Most hacks involve a victim downloading a piece of malicious software or being tricked into handing over login details.

This attack was able to be carried out without any involvement from the victim – a zero-click attack, as it’s known.

“The vibe-coding revolution has introduced a fundamental shift in how developers interact with their tools, and this shift has created an entirely new class of security vulnerability that didn’t exist before,” Moshin told me.

“The whole proposition of having the AI handle things for you comes with big risks.”

Etizaz Mohsin speaking about cyber-security at the prestigious BlackHat conference