I did the thing. You know the one. I got a new laptop, set up my environment, and decided to let GitHub Copilot (in agent mode) loose on my local /dev directory to sync and push my recent "AI experiments" to a new repo. It was fast. It was efficient. It also pushed a hard-coded OpenAI API key straight to a public repo. 🤦♂️ The key is revoked, the damage is zero, but the "Why?" is what’s interesting. As I was cleaning up the mess, I realized that who we blame for this says a lot about how we view the future of engineering. Camp A: The "AI Skeptics" 🚩 The Take: "This is exactly why AI can't be trusted." They’ll argue that a tool capable of scanning a whole directory should have a "security-first" alignment. If it’s smart enough to write the code, it should be smart enough to recognize a sk- prefix and stop the push. To them, this isn't a user error; it's a fundamental failure of AI safety. Camp B: The "AI Optimists" 🚀 The Take: "Skill issue. The human is the pilot." They’ll say it’s 100% my fault. I put the key there. I gave the command. AI is an accelerator, not a babysitter. If you give a power tool to someone and they cut their finger off, you don't blame the saw—you blame the operator for not wearing gloves. The Real Question: As we move from "AI as a Chatbot" to "AI as an Agent" that takes actions on our behalf, where does the buck stop? Is the AI a Collaborator (which implies shared responsibility for "noticing" mistakes)? Or is it just a High-Speed Terminal (where the user is responsible for every single bit and byte)? I’m curious—if this happened on a team project, who are you looking at? The dev who left the key, or the "Agent" that didn't have the "common sense" to redact it? 🎤 #GenerativeAI #GitHubCopilot #AppSec #SoftwareEngineering #AIWorkflows #DevLife
Also. Speaking as someone who has almost chopped a finger off with power tools, but for the fact that they sliced through my glove first and not my finger, I can deeply appreciate the analogy.
Definitely a dev problem. Maybe the first few times this happened (worldwide) it could be forgiven, "we just didn't know how powerful / indiscriminate this tool could be". But the dangers of AI sharing API keys and more to public domain are now well known. Test and check and double check AI output before allowing it to roam wild and free. I am not able/allowed to use AI in my work environment, but I've recently discovered I can use macros/vba and power query to automate my daily spreadsheet entries. I can see the potential in this to make my daily duties more efficient, but that power gives me cause to pause. I'm definitely not going to be releasing my newly found "skills" into production until I have thoroughly tested them and tried to break them. You know, proper testing.