AI 輔助軟體安全
Datasette Finds Authorization and Caching Vulnerabilities Through a Multi-Model Coding Agent Audit; Fixes Land in 1.0a39 and 0.65.4
For the first time, Datasette used Claude and GPT-series agents to conduct a comprehensive security audit, followed by two developers cross-checking the work by writing tests and patches. The new releases tighten controls around private-data permissions, SQL and HTML escaping, authentication, and HTTP caching, but some reproduction tests remain temporarily undisclosed, preventing full independent verification of the vulnerabilities’ scope.
Open-source data publishing tool Datasette has released version 1.0a39 and stable-branch version 0.65.4, delivering a coordinated set of fixes for authorization, SQL construction, HTML output, authentication, and caching issues affecting deployments exposed to the public internet. The highest-risk configuration is an instance that serves both public and private tables while using authentication plugins to restrict access. Maintainers recommend that operators of such deployments upgrade immediately.
The release is also a notable case study in AI-assisted security engineering. After an external researcher submitted an AI-assisted vulnerability report, Simon Willison and Alex Garcia repeatedly searched for similar flaws using Claude Fable 5.1, GPT-5.6 Sol, and GPT-6 Astra. The team did not accept model output directly. The two developers divided the work: one created automated tests that reproduced each issue, while the other implemented the fix. As a result, every issue was reviewed by at least two humans in addition to multiple agents. The maintainers said this was the project’s first comprehensive security audit using coding agents and that the practice will become part of routine development.
The changes in 1.0a39 show that the agents found more than a single vulnerability. The new release ensures that case-insensitive SQLite table names, full-text search index tables, intermediary relationship tables, the foreign-key suggestion API, schema displays, and primary-key parsing all respect the `view-table` permission. Browsing `sqlite_stat1` through `sqlite_stat4` is now denied by default. It also corrects SQL identifier escaping and HTML escaping for untrusted schema column names, renders only URLs validated as HTTP or HTTPS as links, and prevents restricted actors from creating API tokens. Private and personalized dynamic responses now send `Cache-Control: private, no-store`, while anonymous responses vary by Cookie and Authorization headers to prevent shared caches from leaking data across users.
However, the project is temporarily withholding some tests to give administrators time to upgrade before attack details are disclosed. It is therefore difficult to determine the exploitability conditions and severity of every issue at this stage. The case also demonstrates that model-assisted audits are useful for broadening the search space, but cannot replace threat modeling, human code review, regression testing, or a responsible disclosure process.