Even if you don't have cryptocurrency they can still go after your GitHub credentials and run some very expensive agent and runner workloads.
I've started developing with a separate user account to limit the blast radius but you still need to login to access repos and use AI features.
For sure sandboxing and isolation is feeling increasingly relevant regardless, but crypto theft is acting as a good sponge.
now I kinda wanna shadow the usual SSH creds files with LLM read-only user, so it can rummage thru the repos all it wants but I need to do the push using my creds.
That's why I stay away from that dumpster fire too!
[dead]