Vibe coded apps on GrapheneOS

tissue

Is it safe to run vibe coded apps on GrapheneOS?

I'm considering to make an app using AI, and run that on GrapheneOS by installing as APK, but I'm not sure if this is a good choice.

The app is going to run on local only and should not use any networks, but I'm not sure how that would turn out with vibe coding especially when vibe coded apps usually comes with some vulnerabilities, etc.

Johnnyloans

tissue

It's doable, yeah. I think there is a post around here about a vibe coded health data app that shows random numbers for calories burned for 1 user at least.

Quantum

Don't mean hijack your post, but I just hate the phrase vibe coding so much...

Quantum

I don't know anything about making apps, but a good start might be to place it in a separate profile. Maybe look a little into coding and standards so you got sense of how it behaves?

Carrousel7956

Wouldn't an app have to be purposefully malicious to do anything bad without network permission? And even then it would be hard for the app to do anything bad?

de0u

Carrousel7956 Wouldn't an app have to be purposefully malicious to do anything bad without network permission?

Right now a big problem is malicious prompt injection. So somebody might ask an LLM to write an app but not notice that somebody else had injected extra instructions (perhaps via an IDE plugin or a skill) causing the LLM to include code designed to do something bad. A skilled and careful developer who carefully reviewed all the LLM's code might notice, but if the LLM is being steered by a non-expert then all bets are off.

Johnnyloans

Carrousel7956 Wouldn't an app have to be purposefully malicious to do anything bad without network permission?

Tons of projects vibe coded or not, millions of dollars or zero make glaring mistakes.
For example this was not malicious: Database open to the entire world to view their users' government IDs

de0u

Also -- primarily self-hosted -- LLMs can be trained to have "triggers." When asked to do a certain task -- like making an app -- it'll remember to add in malicious code. In every other situation, it tests as 100% safe without the triggers.

Every LLM AI provider could theoretically do this. You just have to trust the black box.

de0u

Johnnyloans You just have to trust the black box.

Or else read the generated code -- which is sort of the opposite of vibe coding.

Johnnyloans

de0u read the generated code

Github: "WHY IS THERE CODE??? MAKE A F&&#ING .EXE FILE AND GIVE IT TO ME."