r/netsec • u/tmlxs • 5d ago

How We Exploited CodeRabbit: From a Simple PR to RCE and Write Access on 1M Repositories

https://research.kudelskisecurity.com/2025/08/19/how-we-exploited-coderabbit-from-a-simple-pr-to-rce-and-write-access-on-1m-repositories/
49 Upvotes

91% Upvoted

4 comments sorted by

11

u/SignificantTwo1729 5d ago

This makes me wonder if AI driven reviewers are just as vulnerable. Tools like cubic dev claim to enforce custom rules and learn from team habits, curious how they’d hold up against exploit attempts like this.

8

u/Vivian_Stringer_Bell 5d ago

This seems like such a wild and easily caught oversight by their team. Does it not kind of invalidate the merits of using their product?

6

u/smiba 5d ago

Amazing work, honestly impressive and concerning how the developers at coderabbit didn't catch this themselves