AI Weekly: Who Signed That Commit

Who Signed That Commit

A Lovable customer asked the platform's agent to swap a link. The chat showed the usual notice that a commit had landed. About a second and a half later, an identical prompt and commit appeared. Same message, same everything, except this one carried malicious code, and it came from a contractor the customer had hired and handed access to the project.

Lovable security engineers Marcus Hallberg and Samuel Kelemen say the group behind it had spent more than a year refining the technique, testing payloads on its own projects before running them against customers. Kelemen's point is that nothing about it is exotic. Anyone invited into a project is "essentially, like, another employee, right? They have all the same access that an employee would in a bigger company." And the agent's signature is easy to wear. "One of my favorite tricks is I always add Marcus on all my commits, as well." His fix is old hygiene: "If we were using commit signing, you wouldn't be able to do this kind of impersonation thing."

The harder question is whose name the agent should use. Should it carry an identity of its own and act on delegated access? "Or should they act as me, right?" The pair compare it to service accounts, where the logs once said which account acted but not who was behind it. Now the same blind spot covers every API key an agent can find on a laptop.

Emilie Schario, a co-founder of Kilo Code, wants the trail down to the line. Agent work has long shipped under the developer's name. "But it can also be helpful to know, yeah, lines one through 4 were me, but lines 5 through 876, that was actually the agent that wrote that."

Airbyte CEO Michel Tricot is designing for the other half, the agent that needs access rather than the one abusing it. His model is the new hire: let it work, narrow its scope, and leave the locked doors visible so it can ask an admin for a grant. The shift, he says, is "because normally you expect some human judgment, but now suddenly you have to trust agent judgment." The job underneath does not change: "you need to keep the control over who is accessing the data."

OpenAI runs close to the opposite bet internally. Tibo Sottiaux, who heads Core Products and Platform there, describes Codex wired into Slack, the documents and the code, with teams working in public channels and broad permissions so it can see everything. An automated security review blocks merges on its own. What is left for people is intent: "what are you even trying to do?"

Varsha Agrawal, head of information security at Prosper Marketplace, has the rule in one line. "Now everything that the AI builds, it needs to have a person that is going to stand behind it."

Three weeks ago nobody had onboarded the agent. Now someone else is wearing its badge.

Sources: Interviews from Cloud Security Podcast (Sep 11, Marcus Hallberg and Samuel Kelemen of Lovable), Tech Lead Journal (Sep 7, Emilie Schario of Kilo Code), Dev Interrupted (Sep 8, Michel Tricot of Airbyte), The Pragmatic Engineer (Sep 9, Tibo Sottiaux of OpenAI), and CISO Series (Sep 8, Varsha Agrawal of Prosper Marketplace).