AI編碼平台故障導致駭客劫持BBC記者筆記型電腦！

A recent investigation by the BBC has revealed a serious security flaw in a popular AI coding platform called Orchids. Orchids is a 'vibe-coding' tool, which means that people can create apps and games just by typing instructions into a chatbot, even if they do not know how to write computer code. This kind of tool has become very popular because it makes building software much easier and faster for everyone. Orchids claims to have a million users, including big companies like Google, Uber, and Amazon. However, a cybersecurity researcher named Etizaz Mohsin showed the BBC that Orchids has a major vulnerability that has not been fixed.

To demonstrate the problem, the BBC reporter downloaded Orchids onto a spare laptop and started a project. Mohsin was able to use a security weakness to get into the reporter's project and add a small line of code without the reporter knowing. Soon after, the reporter saw a notepad file on the desktop that said 'Joe is hacked' and the wallpaper changed to a picture of an AI hacker. This showed that Mohsin could control the computer without the reporter doing anything. This type of attack is called a zero-click attack because the victim does not have to click or download anything for the hacker to get in.

The risks of this kind of attack are very serious. A hacker could use this method to steal private or financial information, install viruses, or even spy on someone through their camera or microphone. Most hacks require the victim to make a mistake, like clicking a bad link, but this one does not. Mohsin said that the rise of vibe-coding tools like Orchids has created new security problems that did not exist before. He tried to warn Orchids about the flaw, but the company did not respond for weeks, saying later that they were overwhelmed with messages. Other experts say that people should be careful when using AI tools that have deep access to their computers. They recommend using separate computers for testing and not putting important information on them. This story is a warning that while AI can make our lives easier, it also brings new risks that we need to manage carefully.