Comment by snovymgodym
3 months ago
Claude code is by all accounts a revolutionary tool for getting useful work done on a computer.
It's also:
- a NodeJS app
- installed by curling a shell script and piping it into bash
- an LLM that's given free reign to mess with the filesystem, run commands, etc.
So that's what, like 3 big glaring vectors of attack for your system right there?
I would never feel comfortable running it outside of some kind of sandbox, e.g. VM, container, dedicated dev box, etc.
None of this is the concerning part. The bad part is that it auto-updates while running without intervention - i.e. it is RCE on your machine for Anthropic by design.
So we’re declaring all software with auto-updaters as RCE? That doesn’t seem like a useful distinction.
Software that automatically phoned home to check if an update is available used to be considered spyware if there wasn't a prompt at installation asking if you wanted that. The attitude was "Why should some company get my IP address and a timestamp telling them when/how often I'm online and using their software?" Some people thought that was paranoid.
We gave them an inch out of fear ("You'd better update constantly and immediately in case our shitty software has a bug that's made you vulnerable!") and today they've basically decided they can do whatever the fuck they want on our devices while also openly admitting to tracking our IPs and when/how often we use their software along with exactly what we're using it for, the hardware we're using, and countless other metrics.
Honestly, we weren't paranoid enough.
2 replies →
That’s pretty much the definition. Auto updating is trusting the developer (Almost always a bad idea).
5 replies →
Mine doesn’t auto update. I set it up so it doesn’t have permission to do that.
Not only that, but also connects to raw.githubusercontent.com to get the update. Doubt there are any signature checks happening there either. I know people love hating locked down Apple ecosystem, but this kind of stuff is why it is necessary.
I definitely think running agents in sandboxes is the way to go.
That said Claude code does not have free reign to run commands out of the gate.
Pet peeve - it's free rein, not free reign. It's a horse riding metaphor.
Bah, well I have been using that incorrectly my entire life. A monarchy/ruler metaphor seems just as logical.
1 reply →
Yes it does; you are thinking of agent tool calls. The software package itself runs as your uid and can do anything you can do (except on macOS where reading of certain directories is individually gated).
Claude Code is an agent. It will not call any tools or commands without your prior consent.
Edit: unless you pass it an override like --dangerously-skip-permissions, as this malware does. https://www.stepsecurity.io/blog/supply-chain-security-alert...
Ok, but that’s true of _any_ program you install so isn’t interesting.
I don’t think the current agent tool call permission model is _right_ but it exists, so saying by default it will freely run those calls is less true of agents than other programs you might run.
1 reply →
So what?
It doesn't run by itself, you have to choose to run it. We have tons of apps with loads of permissions. The terminal can also mess with your filesystem and run commands... sure, but it doesn't open by itself and run commands itself. You have to literally run claude code and tell it to do stuff. It's not some living, breathing demon that's going to destroy your computer while you're at work.
Claude Code is the most amazing and game changing tool I've used since I first used a computer 30 years ago. I couldn't give two fucks about its "vectors of attack", none of them matter if no one has unauthorized access to my computer, and if they do, Claude Code is the least of my issues.
It doesn't have to be a deliberate 'attack', Claude can just do something absurdly inappropriate that wasn't what you intended.
You're absolutely right! I should not have `rm -rf /bin`d!
I would say this is a feature, not a bug.
Terminal and Bash or any shell can do this, if the user sucks. I want Claude Code to be able to do anything and everything, that's why it's so powerful. Sure, I can also make it do bad stuff, but that's like any tool. We don't ban knives because sometimes they kill people, because they're useful.
3 replies →
I don’t use Claude, but can it really run commands on the cli without human confirmation? Sure there may be a switch to allow this but If in that case all but the most yolo must be using it in a container?
3 replies →
> I couldn't give two fucks about its "vectors of attack", none of them matter if no one has unauthorized access to my computer, and if they do, Claude Code is the least of my issues.
Naive! Claude Code grants access to your computer, authorized or not. I'm not talking about Anthropic, I'm talking about the HTML documentation file you told Claude to fetch (or manually saved) that has an HTML comment with a prompt injection.