Is an AI-Written App Safe to Run?
A friend shipped a free PDF app written entirely by AI, and before I ran it, I read the code. The app is Folio by Matthew Berman, a free, open source PDF reader for Windows, macOS and Linux. You can ask AI about your documents with your own ChatGPT sign in or your installed Claude Code. PDFs have a long history of exploits, and I do a lot of mission critical stuff, so I wanted to see how it opens links before I trusted it. I opened a Droid session on Opus 5.5 and asked it for a security read. Droid's read: no direct way for a bad PDF to run code on my Mac, but links in a PDF went straight to your browser without asking, which is a phishing risk and shows your IP address to whoever runs the link. I also get into printing, because print rereads all the bytes again. Folio's SECURITY.md asks for security problems to be reported privately, so that's what I did. Matt shipped the fixes in less than 24 hours and thanked me on X. Build things, and work with other engineers who can check them. That's a big reason people publish open source. Folio: https://github.com/Forward-Future/folio The fix, commit cd8855b, shipped in Folio 1.10.8: https://github.com/Forward-Future/folio/commit/cd8855b More fixes in PR 35, shipped in 1.10.9: https://github.com/Forward-Future/folio/pull/35 Changelog: https://github.com/Forward-Future/folio/blob/main/CHANGELOG.md Matt's post: https://x.com/MatthewBerman/status/2116570347373986297 Watch the full livestream: https://youtu.be/le4SUudngW4 Wispr Flow: https://rfer.me/wispr This is my referral link. Download SayRay on the App Store: https://rfer.me/sayray I spent 12 years as an engineer at Apple, and now I build apps live on stream with AI tools and share the whole process as I go. Join the free community where we're all building together: https://rfer.me/startmyai (The AI Builder Club, my small live cohort, opens a few times a year, and you'll hear about it first inside the community.) Timestamps powered by https://raytranscribes.com Chapters 0:00 A Friend Shipped an App Written by AI 0:29 Your Own PDF Reader With AI 0:51 Step 1. Know Why PDFs Are Risky 1:12 Step 2. Read It Before You Run It 1:27 Step 3. Ask Droid the Hard Questions 2:14 Droid's Read. Links Open Without Asking 2:53 Step 4. Report It Privately 3:57 Fixed in Less Than 24 Hours 4:10 Come Build With Us
